Prepare a security finding for a useful triage conversation
A free evidence brief for separating a scanner observation, the affected component, ownership, and unanswered questions.
Published October 15, 2026 · Programming Securely · Original exercise with illustrative examples
Record the observation without expanding the claim
Start with the tool, rule, repository revision, and the location or component the report actually names. A scanner result is a reason to investigate; it does not by itself establish a running production exposure or successful exploitation. Keep raw credentials, secret values, private source, and customer data out of a general triage note. Use a sanitized description when the exact evidence belongs in a restricted system.
Trace the component and name what is unknown
Ask which version or artifact contains the component, where that artifact is deployed, and what access is required to reach the relevant behavior. Mark a missing link as unknown. Mayo ASPM inventories repositories and components and applies organization-specific triage rules; a priority rule is a decision aid, not independent proof that a finding is exploitable or harmless. Record the reasoning behind a proposed priority.
Agree on the next verification
Choose one bounded action, an owner who has accepted it, and the evidence that would answer the open question. That action might be confirming an installed version or reproducing behavior in an authorized test environment. Keep the result beside the original finding so a later reviewer can understand the decision. This worksheet does not scan a target, run an exploit, upload a report, or create a Jira issue.
Worked example
A small situation to try
Illustrative triage: a report names a dependency in a repository lockfile. The brief records the exact revision and version reported, but the deployed artifact is unknown. The accepted next action is to compare an authorized build’s component inventory with the report. The finding stays unresolved until that evidence is checked.
Try it here · No account needed
Your working notes
This worksheet does not send your writing to Mayo ASPM, save it to an account, or store it in your browser. Notes are cleared when you leave or reload this page. Download a text copy if you want to keep them.
Name tool, rule, revision, and reported component; omit secrets.
Separate confirmed links from missing evidence.
Record who can investigate and why the proposed timing fits the evidence.
Choose one authorized check and the result needed.
What to do next
Use what you learned
Keep sensitive evidence in the restricted finding system.
Have the responsible team review the brief and choose an authorized verification step.
Return to the product for its current features and availability. This independent worksheet changes no account data.
About this guide
Published by Programming Securely for Mayo ASPM. Product descriptions are checked against this project’s documentation. Examples are fictional and are kept separate from observed product behavior. The worksheet helps you prepare a note; it does not replace the product’s current documentation.
For a correction, use the product’s contact or support link on its homepage and name this guide and the passage that needs review.