Findings Triage

Severity, reachability, and false positives — triage SAST on YOUR $REPO findings.

Findings Triage• Audio Walkthrough

00:00/02:44

Visual · t17_findings_triage

Not every SAST hit is a bug — triage before panic. Original Cyberlium.

A thousand findings mean nothing until you sort signal from noise on code you can fix.

Triage SAST results: read rule ID and message, confirm sink/source in YOUR code path, check if dead code or test-only, rate severity (CWE mapping literacy), decide fix vs suppress with ticket. Document suppressions with justification and expiry — never blanket ignore rules on $REPO to greenwash CI. Practice triage on lab findings you introduced and removed — never publish stranger repo scan dumps or shame open-source maintainers with unverified reports.

1. Triage steps

Reproduce in source — click through file:line. Ask: attacker-controlled input reaches sink?

Check framework defaults — some rules misfire on safe wrappers.

Command guide

Try these commands — Triage steps

═══ LINUX / BASH (Network & Reconnaissance Audit) ═══

Scan target host for open ports and service version signatures

Command — copy this

nmap -sS -sV -p 80,443,8080 -Pn ${LAB_HOST:-127.0.0.1}

DNS and WHOIS reconnaissance on authorized domain

Command — copy this

dig +short A target.local
dig +short MX target.local
whois target.local 2>/dev/null | grep -iE "(Registrar|Creation Date|Name Server)" | head -6

Inspect HTTP headers for technology stack fingerprinting

Command — copy this

curl -s -I "http://${LAB_HOST:-127.0.0.1}:8080" | grep -iE "(Server|X-Powered-By|Set-Cookie|Content-Security-Policy)"

Primary tools to practice this lesson: grep, python3. Reference sites: SAST triage (https://cheatsheetseries.owasp.org/cheatsheets/Source_Code_Analysis_Tools_Cheat_Sheet.html); Semgrep (https://semgrep.dev/docs/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.