Repository navigation
AI-assisted H1 report triage - TSC 2026-05-27 follow up #1566
Description
Activity
Hi folks, could you please join the next security release meeting?
Hi @RafaelGSS, sure! I will keep an eye out on the security-wg issues for the next meeting date and zoom link ;)
Hi guys, looks like the meeting fell during my time off. I'm free any time for a quick 20 min catch-up, or I'll join the next one -keen to pick the triage thread back up either way! Cheers @RafaelGSS
Hi team!
@RafaelGSS suggested I do a very quick recap of what the Konvu product does for everyone to be on the same page, so here is the rundown:
- Ingests HackerOne reports into a single triage view.
- Uses the Node.js threat model and program scope for first-pass triage.
- Filters duplicates, spam, and out-of-scope reports early.
- For credible in-scope reports, can deploy the relevant code in a sandbox and replay the POC to help validate exploitability.
Setup is simple:
- Join the provisioned Node.js workspace on Konvu. (login at https://community.konvu.com, and I'll add you to the workspace)
- Connect the Node.js HackerOne workspace by adding the API key.
As mentioned already, we're not commercializing the product just yes and are just looking for consistent feedback while helping solve a real pain point for you :)
Hi all,
As discussed in TSC issue #1858 with @vdeturckheim and @RafaelGSS, I would be happy to hear more about how you guys have been dealing with the flood of AI generated vulnerability reports.
As I mentioned, we're building Konvu Community to deal with this precise issue. The platform is free for open source and we are looking forward to getting feedback from people experiencing triage fatigue :)
What time would be more convenient for you to meet ?
Cheers,
Hedi