Skip to content

Draw the data flow of a triage in the README #45

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
alexandre-daubois merged 1 commit into from
Nov 4, 2026
Merged

Draw the data flow of a triage in the README #45

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 39 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,45 @@ Plausible signed `char` passed to `isxdigit()` in `php_url_decode_ex()`, the giv

The agent runs in an isolated container driven by [harness](https://github.com/alpha-omega-security/harness), the Alpha-Omega library behind [scrutineer](https://github.com/alpha-omega-security/scrutineer). [Security](docs/security.md) describes what the sandbox allows.

```mermaid
flowchart LR
subgraph gh["GitHub"]
adv[("Advisory in triage")]
others[("Other advisories,<br/>embargoed and closed")]
pub["Public issues<br/>and pull requests"]
board["Private project board"]
end

subgraph runner["Runner of the private workflow repository"]
tamis["tamis"]
proxy["Model proxy,<br/>holds the API key"]
art[("Private artifact,<br/>kept 7 days")]
end

subgraph sandbox["Throwaway containers, no secret"]
reader["Agent reading the report<br/>against a read-only clone"]
dup["Offline agent<br/>searching duplicates"]
confirm["Offline agent confirming<br/>one unpublished candidate"]
end

provider["Model provider"]

adv -->|report and comments| tamis
others -->|read with the App token| tamis
tamis -->|report and source| reader
reader -->|unauthenticated search| pub
reader -->|report.json| tamis
tamis -->|"report, checked clues,<br/>every other advisory"| dup
dup -->|identifiers and confidence| tamis
tamis -->|"candidate without<br/>its identifier"| confirm
confirm -->|exact or not| tamis
reader & dup & confirm -.->|model requests| proxy
proxy --> provider
tamis -->|checked, escaped comment| adv
tamis -.->|board item| board
tamis -->|complete result| art
```

## Before installing

GitHub cannot post confidential advisory comments yet, so with `comment: true` the reporter reads the comment. tamis also sends the report to the model provider you choose. Check that your disclosure policy allows both.
Expand Down
Loading