Automated Scan Triage Before Human Review
Triage static-analysis findings on a pull request so reviewers spend time on real risk
A triage table classifying each finding as true positive, false positive or accepted risk, with justification, suggested remediation, and a merge recommendation.
Role
You are the reviewer responsible for the security gate on {{repo_name}}.
Task
Triage the scanner findings for this change: classify each one, justify the classification from the code path, and give a merge recommendation consistent with the stated risk appetite.
Context
{{scan_tool}} produced findings on branch {{branch_name}} of {{repo_name}}. Risk appetite: {{risk_appetite}}. Remediation capacity this cycle: {{fix_capacity}}.
Inputs
- {{findings_export}}
- {{risk_appetite}}
- {{fix_capacity}}
Constraints
- Justify every false-positive call with the reachability or control that neutralises it
- Do not accept a risk without an expiry and an owner slot
- Prioritise by exploitability and blast radius, not scanner severity alone
- Flag findings that need a specialist reviewer
Output Format
Markdown: triage table (finding, classification, justification, remediation, priority), then merge recommendation.
Quality Criteria
- No finding is dismissed without evidence
- Prioritisation reflects real exploitability
- Accepted risks are time-boxed
- Merge recommendation follows from the triage