Triage static analysis findings by real risk
Ranks static analysis findings by real risk, separates likely false positives, and names the three to fix first with a reason each.
Task:
Triage the static analysis findings below and tell me which three to fix first.
Context:
The code is [language and framework] and the tool is [analyzer name]. The code runs as [what the code does, who can reach it]. I have about [hours available] to spend on fixes.
Rules:
- Read each finding together with the code lines it points to before judging it.
- Rank by real risk for my case, not by the severity label the tool gave.
- Mark a finding as a likely false positive only when you can explain why in one sentence.
- When a fix would delete data or rewrite history, explain that first and wait for my go-ahead.
- Ask for no secrets or keys in the chat. If a finding shows one, tell me to rotate it.
Result:
A table with the columns finding, file, real risk (high, medium, low or likely false positive) and reason in at most 15 words. Under it, the three to fix first with the fix in one sentence each.
Material:
[paste the findings and the code lines they point to here]