AI-assisted H1 report triage - TSC 2026-05-27 follow up

[hedi-cmd]

Hi all,

As discussed in TSC issue #1858 with @vdeturckheim and @RafaelGSS, I would be happy to hear more about how you guys have been dealing with the flood of AI generated vulnerability reports.

As I mentioned, we're building Konvu Community to deal with this precise issue. The platform is free for open source and we are looking forward to getting feedback from people experiencing triage fatigue :)

What time would be more convenient for you to meet ?

Cheers,

Hedi

[RafaelGSS]

Hi folks, could you please join the next security release meeting?

[hedi-cmd]

Hi @RafaelGSS, sure! I will keep an eye out on the security-wg issues for the next meeting date and zoom link ;)

[hedi-cmd]

Hi guys, looks like the meeting fell during my time off. I'm free any time for a quick 20 min catch-up, or I'll join the next one -keen to pick the triage thread back up either way! Cheers @RafaelGSS

[hedi-cmd]

Hi team!

@RafaelGSS suggested I do a very quick recap of what the Konvu product does for everyone to be on the same page, so here is the rundown:

• Ingests HackerOne reports into a single triage view.
• Uses the Node.js threat model and program scope for first-pass triage.
• Filters duplicates, spam, and out-of-scope reports early.
• For credible in-scope reports, can deploy the relevant code in a sandbox and replay the POC to help validate exploitability.

Setup is simple:

• Join the provisioned Node.js workspace on Konvu. (login at https://community.konvu.com, and I'll add you to the workspace)
• Connect the Node.js HackerOne workspace by adding the API key.

As mentioned already, we're not commercializing the product just yes and are just looking for consistent feedback while helping solve a real pain point for you :)