Skip to content

TriageGuard

TriageGuard is an autonomous validator for vulnerability reports.

Code Video Cerebral Valley

Core trick

Four parallel agents write structured JSON findings, and a deterministic non-LLM synthesizer maps them to a reproducible 0-100 score.

Tags

securitydev tools

Description

TriageGuard is an autonomous validator for vulnerability reports. Drop in a report + PoC + claimed affected code; it returns a Signal-vs-Slop verdict with auditable reasoning, end to end and unattended. The bug bounty industry is collapsing under AI-generated low-quality reports. HackerOne paused the Internet Bug Bounty program on 2026-03-27 after 13 years; curl ended its program in January; valid-submission rates at major OSS programs fell from ~15% to under 5%. The bottleneck has shifted from **discovery** to **validation** — and that is the bottleneck TriageGuard attacks. The orchestrator (Python, Claude Agent SDK) fans out four parallel Opus 4.7 sub-agents at `xhigh` effort: Each sub-agent writes a strict JSON artifact to `findings/{report_id}/`. A **deterministic synthesizer** (no LLM) maps the four artifacts to a 0–100 Signal Score using the rubric in `signal-score-rubric/SKILL.md`. The verdict is auditable, reproducible, and cheap. Haiku 4.5 runs a preflight digest before fan-out (~$0.0015, ~1.5s) that extracts the report's claimed bug class, locations, and evidence — surfaced in the CLI and the synthesizer narrative as a fast sanity check. The web UI streams the same artifacts via SSE. Primary target: **wolfSSL** (~5B devices). The eval set includes two of my own published wolfSSL CVEs (CVE-2026-3849, CVE-2026-2646), plus two public curl slop reports and one live-generated slop sample. Built by a bug-bounty researcher with 9 published CVEs across wolfSSL, Mozilla NSS, and PowerDNS. *"I helped create this crisis. TriageGuard is my contribution to solving it."*
HarutoKimura/triageguard★ 12 forksPythonMITCreated Apr 24, 2026 · last push Apr 26, 2026

README excerpt

# TriageGuard

**Autonomous validator for vulnerability reports.** Drop in a report
+ PoC + claimed affected code; get back a Signal-vs-Slop verdict with
reasoning in ~12 minutes.

**Demo video (3 min):** https://youtube.com/shorts/jqrxefYqbO4

> Built for the Anthropic "Built with Opus 4.7" hackathon,
> 2026-04-21 – 2026-04-28.

## Why

The bug bounty industry is collapsing under AI-generated low-quality
reports. HackerOne paused the Internet Bug Bounty program on
2026-03-27 after 13 years. Google's OSS VRP rejects AI-generated
submissions outright. curl ended its program. Valid submission rate
at major programs dropped from ~15 % to under 5 %.

The ecosystem bottleneck has shifted from **discovery** to
**validation**. TriageGuard attacks that new bottleneck.

## How it works

```mermaid
flowchart LR
    INPUT["INPUT<br/>Report + PoC<br/>+ claimed code"]
    ORCH["ORCHESTRATOR<br/>Python · Claude Agent SDK<br/>fan-out · fan-in<br/><i>Haiku 4.5 — glue / routing</i>"]
    A["REPRODUCIBILITY<br/>build · run PoC<br/>capture trace"]
    B["ROOT CAUSE<br/>read source<br/>trace data flow"]
    C["DUPLICATE<br/>CVE / advisories<br/>git log"]
    D["HALLUCINATION<br/>functions / APIs<br/>line refs"]
    FIND["findings/{report_id}/<br/>repro.json<br/>root_cause.json<br/>duplicate.json<br/>hallucination.json"]
    SYN["SYNTHESIZER<br/>weighted rubric<br/>reasoning trace<br/><i>Opus 4.7 (xhigh)</i>"]
    VER["VERDICT<br/>Signal Score 0–100<br/>SIGNAL · UNCERTAIN · SLOP"]

    INPUT -->

Team