[Security Triage] Triage Report — 2026-03-26
Summary
| Metric |
Count |
| Total alerts reviewed |
50 |
| Classification: fix |
50 |
| Classification: false-positive |
0 |
| Fast-track (critical/high) |
37 |
| Batched (medium) |
13 |
Breakdown by Severity
| Severity |
Count |
Alerts |
| Critical |
12 |
#3-5 (cmd injection), #22-27 (SSRF/XXE), #34-37 (deserialization/SSTI) |
| High |
25 |
#1-2, #14-15 (SQL injection), #6-13 (Flask debug), #16-21 (weak crypto), #28-33 (path traversal/XML bomb) |
| Medium |
13 |
#38-50 (XSS, command injection) |
Breakdown by CWE Category
| CWE |
Category |
Count |
Alerts |
| CWE-078 |
Command Injection |
7 |
#3, #4, #5, #39, #40, #41, #42 |
| CWE-089 |
SQL Injection |
4 |
#1, #2, #14, #15 |
| CWE-079 |
Cross-Site Scripting (XSS) |
8 |
#38, #43, #44, #45, #46, #47, #48, #49, #50 |
| CWE-918 |
Server-Side Request Forgery (SSRF) |
5 |
#22-26 |
| CWE-611 |
XML External Entity (XXE) |
1 |
#27 |
| CWE-776 |
XML Internal Entity Expansion |
2 |
#32, #33 |
| CWE-502 |
Unsafe Deserialization |
3 |
#34, #35, #36 |
| CWE-094 |
Server-Side Template Injection |
1 |
#37 |
| CWE-327 |
Weak Cryptographic Algorithm |
6 |
#16-21 |
| CWE-022 |
Path Traversal |
4 |
#28-31 |
| CWE-215 |
Flask Debug Mode |
8 |
#6-13 |
Priority Tier Summary
- Fast-track (critical + high): 37 alerts — processed first, each with individual branch and PR
- Batched (medium): 13 alerts — XSS and other medium findings processed after fast-track items
Fix PRs
Critical Alerts (12)
High Alerts (25)
Medium Alerts (13)
GitHub Projects Board
Note: The GitHub PAT token used for this triage does not have the read:project scope required to interact with the Projects board (#4). Tracking issues have been created for all 50 alerts and should be manually added to the Projects board. Each issue should be set to In Review status since all alerts have corresponding open PRs.
Alerts Needing Human Judgment
None — all 50 alerts were classified as fix with proposed remediation PRs. All PRs are ready for human review and merge.
Next Steps
- Review and merge each fix PR
- CodeQL alerts will auto-resolve when their corresponding PRs are merged into main
- Add tracking issues to the Projects board and set status to In Review
- After all PRs are merged, update Projects board items to Done
Generated by automated CodeQL triage on 2026-03-26
[Security Triage] Triage Report — 2026-03-26
Summary
Breakdown by Severity
Breakdown by CWE Category
Priority Tier Summary
Fix PRs
Critical Alerts (12)
High Alerts (25)
Medium Alerts (13)
GitHub Projects Board
Alerts Needing Human Judgment
None — all 50 alerts were classified as
fixwith proposed remediation PRs. All PRs are ready for human review and merge.Next Steps
Generated by automated CodeQL triage on 2026-03-26