Summary
This epic tracks the ongoing work to build AI-assisted security issue triaging for Flatcar. The goal is a Flatcar-focused assistant that helps surface security issues relevant to Flatcar, supports drafting and maintaining advisories in our existing style, and helps keep the advisory backlog current.
This is not a generic CVE scanner. It is a purpose-built assistant tailored to Flatcar's needs, where all final decisions remain human-validated.
Motivation
Security triaging for Flatcar is currently a manual, time-consuming process. Automating the repetitive parts - things like extraction, summarization, relevance filtering, and spotting duplicate or stale items, frees maintainers to focus on judgment calls while keeping advisory quality consistent.
Scope
At a high level, the work focuses on assisting with:
- Tracking new vulnerabilities - helping identify and draft advisories for issues relevant to Flatcar.
- Keeping the backlog healthy - helping review existing advisories and flag ones that may already be resolved.
The exact workflows, sources, and rules will be refined as the work progresses.
Guiding principles
- Keep the assistant Flatcar-focused, applying relevance criteria appropriate to the project.
- Treat all LLM output as advisory input only. Nothing is created, updated, or closed solely because a model recommended it - humans stay in the loop.
- Favor approaches that are transparent, reviewable, and easy to validate.
Where the work lives
The code will live here: https://github.com/flatcar/security-triage
How to get involved
/cc @danielszot @t-lo @dongsupark
Summary
This epic tracks the ongoing work to build AI-assisted security issue triaging for Flatcar. The goal is a Flatcar-focused assistant that helps surface security issues relevant to Flatcar, supports drafting and maintaining advisories in our existing style, and helps keep the advisory backlog current.
This is not a generic CVE scanner. It is a purpose-built assistant tailored to Flatcar's needs, where all final decisions remain human-validated.
Motivation
Security triaging for Flatcar is currently a manual, time-consuming process. Automating the repetitive parts - things like extraction, summarization, relevance filtering, and spotting duplicate or stale items, frees maintainers to focus on judgment calls while keeping advisory quality consistent.
Scope
At a high level, the work focuses on assisting with:
The exact workflows, sources, and rules will be refined as the work progresses.
Guiding principles
Where the work lives
The code will live here: https://github.com/flatcar/security-triage
How to get involved
/cc @danielszot @t-lo @dongsupark