Vulnerability Triage

Overview

A list of suspicions is not an audit. What makes a report worth a reader's time is that someone tried to prove each item wrong and failed.

Core principle: a finding you have not attacked is a guess with a severity label on it.

The Iron Law

NAME THE INPUT, OR IT IS NOT A FINDING

If you cannot describe a concrete value that reaches the dangerous call — a URL, a header, a filename, a JSON body — you have found a code smell, not a vulnerability. Say so, and move on to the next candidate.

Phase 1 — Read the path, not the rule

mcp__thot__audit gives you candidates with a reconstructed taint path. Before opening any file:

• mcp__thot__callers on the sink's symbol — who reaches it, and how far from an entry point?
• Distance matters more than the rule name. A CRITICAL sink nothing calls is worth less than a MEDIUM one on a public route.

Phase 2 — Name the input

Open the file. Follow the value backwards from the sink to its origin.

Write one sentence containing:

1. the exact entry point (route, CLI flag, queue, environment variable),
2. a literal payload,
3. what the payload causes.

GET /ping?host=127.0.0.1;id reaches os.system at handlers.py:9 through request.args.get("host"), and the shell runs id after the ping.

If you cannot fill all three slots, the verdict is plausible at best.

Phase 3 — Attack your own finding

Now argue the other side, with the burden of proof reversed. Look for:

• a validation or a cast between source and sink,
• a caller that only ever passes literals,
• a type that forbids the payload you assumed,
• a framework guard, a decorator, an allow-list,
• an execution context where the entry point is unreachable.

On doubt, refute. A false positive costs the reader more than a missed true positive costs you: one destroys trust in the whole report, the other is found by the next pass.

Phase 4 — Report what survives

For each surviving finding:

• location, severity, the sentence from Phase 2,
• what you tried in Phase 3 and why it failed to kill the finding,
• the smallest fix that breaks the chain — a cast, a parameterised query, shlex.quote, an allow-list. Not a rewrite.

Findings that died in Phase 3 belong in the report too, in one line each. They are the evidence that the rest was attacked.

Anti-patterns