Overview — CVE Triage Playbook

A decision framework for turning a wall of dependency-scanner alerts into a

ranked, defensible action list. When a scanner (Dependabot, Trivy, Snyk, `npm

audit, pip-audit`) reports 60 "critical" CVEs, most are noise for *your* app —

this playbook tells you which ones actually matter, in what order, and why.

The problem it solves

Automated scanners over-report. A CVE marked "critical" by CVSS may be

unreachable in your code, gated behind auth, or in a dev-only dependency. Teams

either drown (fix everything, break prod) or freeze (ignore all, get breached).

This playbook gives you a repeatable triage that a human — or an agent doing a

security pass — can apply in minutes per finding.

What's inside

• TRIAGE-FRAMEWORK.md — the 6-question decision tree (reachability, exposure,

exploit maturity, data sensitivity, fix cost, blast radius) with a scoring rubric.

• SEVERITY-RUBRIC.md — how to re-score a raw CVSS into an *environmental* priority

(P0/P1/P2/P3) for your actual deployment, with worked examples.

• examples/triage-log.md — 8 real-shaped worked examples (Log4Shell-class RCE,

a transitive dev-dep, an unreachable path, a DoS behind auth) showing the

reasoning end to end.

• examples/triage.py — a tiny, dependency-free scorer that takes the 6 answers

and outputs a P-level + recommended SLA, so the framework is executable.

How to use it (5 steps)

1. Export scanner findings to a list.

2. For each, answer the 6 triage questions (TRIAGE-FRAMEWORK.md).

3. Run triage.py (or score by hand) to get a P-level.

4. Sort by P-level; assign SLAs (P0 now, P1 this week, P2 this sprint, P3 backlog).

5. Record the decision in a triage log so "won't fix" is defensible at audit time.

Requirements

• None to read/apply. triage.py needs Python 3.8+ (standard library only).

Who this is for

Engineers and security reviewers who own a service's dependencies, and agents

performing an automated security triage that must produce *ranked, justified*

output instead of "here are 60 criticals."