Secure › Module 7 › Lesson 2
Findings Triage
Severity, reachability, and false positives — triage SAST on YOUR $REPO findings.
Visual · t17_findings_triage
Not every SAST hit is a bug — triage before panic. Original Cyberlium.
Opening
A thousand findings mean nothing until you sort signal from noise on code you can fix.
Triage SAST results: read rule ID and message, confirm sink/source in YOUR code path, check if dead code or test-only, rate severity (CWE mapping literacy), decide fix vs suppress with ticket. Document suppressions with justification and expiry — never blanket ignore rules on $REPO to greenwash CI. Practice triage on lab findings you introduced and removed — never publish stranger repo scan dumps or shame open-source maintainers with unverified reports.
1. Triage steps
Reproduce in source — click through file:line. Ask: attacker-controlled input reaches sink?
Check framework defaults — some rules misfire on safe wrappers.
Command guide
Try these commands — Triage steps
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
SAST triage — https://cheatsheetseries.owasp.org/cheatsheets/Source_Code_Analysis_Tools_Cheat_Sheet.html Semgrep — https://semgrep.dev/docs/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
grep -rn 'TODO.*security\|FIXME.*auth' "$HOME/cyberlium-lab/t17-toy" 2>/dev/null | head -5 || echo 'No security TODOs flagged yet'
python3 -c "print('Triage: true_positive | false_positive | wont_fix + reason')"Primary tools to practice this lesson: grep, python3. Reference sites: SAST triage (https://cheatsheetseries.owasp.org/cheatsheets/Source_Code_Analysis_Tools_Cheat_Sheet.html); Semgrep (https://semgrep.dev/docs/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Severity literacy
Critical: auth bypass, RCE pattern in reachable code. Low: style or test fixture.
CWE IDs link to teaching material — use for notes, not Twitter dunking.
3. Suppression discipline
Inline nosemgrep with reason + issue link — not delete the rule globally without review.
Re-scan after fix; confirm finding count drops on $REPO.
4. What you ship: triage worksheet
Five triage steps + one worked example from $REPO + suppression policy line.
5. What you record before the next lesson
Triage worksheet path.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
File public GitHub issue on stranger repo from unverified SAST hit.
Right
Name triage steps. Next: CI gate.
Mission: triage one finding
1) Run SAST on $REPO. 2) Triage one true and one false positive. 3) Write NEVER dump stranger scan results publicly.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “When is nosemgrep acceptable?”
Knowledge Check
APPLY: Triage first asks:
Multiple choice
Knowledge Check
APPLY: True or False: Blanket ignore all SAST rules is good.
True or False
Knowledge Check
APPLY: Suppression should include:
Multiple choice