Skip to content

docs: add vulnerability triage decision table to dependency audit guide #1125

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
utksh1 merged 1 commit into from
Jun 20, 2026
Merged

docs: add vulnerability triage decision table to dependency audit guide #1125

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions docs/dependency_audit_operator_guide.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,3 +89,17 @@ To generate a CycloneDX 1.4 compatible SBOM containing all frontend and backend
```bash
python scripts/generate_sbom.py --output sbom.json --include-dev
```

---

## 3. Vulnerability Triage Decision Table

When an audit surfaces a finding, use the following table to classify it into one of three categories and determine the appropriate operator response. Classification is driven by severity, exploitability, and whether the affected package ships to production.

| Category | Criteria | Operator Action | Example |
| :--- | :--- | :--- | :--- |
| **Informational** | `low` severity findings with no exploit path, or findings confined to dev-only dependencies. | Note and monitor; no immediate action required. | A `low` CVE in a build-time dev dependency that is not shipped to production. |
| **Urgent** | `high` or `critical` findings with a known fix available, or a plausible exploit path in production dependencies. | Schedule a patch within the current sprint and file a tracking ticket. | A `high` CVE in a runtime HTTP library with a patched version released. |
| **Blocking** | `critical` findings with active exploitation, no available fix, or affecting authentication/secrets handling. | Stop deployment; apply mitigation or a temporary exception with security-team approval immediately. | A `critical` RCE in a core runtime dependency with no patch. |

Blocking findings that require a temporary allowance to unblock deployment must be documented using the exception format described in [Section 1](#1-exception-configuration-format).
Loading