From 356d8f1acb22bef33df410e6702a02990667d8a6 Mon Sep 17 00:00:00 2001 From: Alexandre Daubois Date: Wed, 4 Nov 2026 10:42:26 +0100 Subject: [PATCH] Draw the data flow of a triage in the README --- README.md | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/README.md b/README.md index 1d0cf58..7b2c0e6 100644 --- a/README.md +++ b/README.md @@ -34,6 +34,45 @@ Plausible signed `char` passed to `isxdigit()` in `php_url_decode_ex()`, the giv The agent runs in an isolated container driven by [harness](https://github.com/alpha-omega-security/harness), the Alpha-Omega library behind [scrutineer](https://github.com/alpha-omega-security/scrutineer). [Security](docs/security.md) describes what the sandbox allows. +```mermaid +flowchart LR + subgraph gh["GitHub"] + adv[("Advisory in triage")] + others[("Other advisories,
embargoed and closed")] + pub["Public issues
and pull requests"] + board["Private project board"] + end + + subgraph runner["Runner of the private workflow repository"] + tamis["tamis"] + proxy["Model proxy,
holds the API key"] + art[("Private artifact,
kept 7 days")] + end + + subgraph sandbox["Throwaway containers, no secret"] + reader["Agent reading the report
against a read-only clone"] + dup["Offline agent
searching duplicates"] + confirm["Offline agent confirming
one unpublished candidate"] + end + + provider["Model provider"] + + adv -->|report and comments| tamis + others -->|read with the App token| tamis + tamis -->|report and source| reader + reader -->|unauthenticated search| pub + reader -->|report.json| tamis + tamis -->|"report, checked clues,
every other advisory"| dup + dup -->|identifiers and confidence| tamis + tamis -->|"candidate without
its identifier"| confirm + confirm -->|exact or not| tamis + reader & dup & confirm -.->|model requests| proxy + proxy --> provider + tamis -->|checked, escaped comment| adv + tamis -.->|board item| board + tamis -->|complete result| art +``` + ## Before installing GitHub cannot post confidential advisory comments yet, so with `comment: true` the reporter reads the comment. tamis also sends the report to the model provider you choose. Check that your disclosure policy allows both.