mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 22:13:18 +09:00
Timur Tukaev
ea3d68493a
The previous commit narrowed a true statement into a false one. It said the scanner gap was remediation throughput and that triage ran on schedule; triage is also behind, and the backlog awaiting a triage decision includes findings at critical severity well past the one-business-day target. Both tracks are now stated as behind. Figures stay out of this repository for the disclosure reason the document already gives and belong in the private channel, so the admission is qualitative rather than rounded down. The nightly characterisation was also wrong. It read as fixed-then-regressed, which understates it: after the fix in #3332 the scheduled run passed for four days, went red for five, passed for three, and has failed every run since 2026-08-02 — seven of the last twenty-four passed. It is flapping, not newly broken, and the current failure is untriaged rather than provably unfiled. Carry the target-attainment caveat into SECURITY.md, which stated the triage SLAs with no indication they are not being met, and resync the self-assessment on the monthly report: it names findings individually and so is not publishable until reduced to counts by severity. Also note in SECURITY.md what the activity test actually classifies today — every 1.x line from 1.0 to 1.6 — and how backport effort is prioritised across that set, since supporting seven lines in parallel otherwise invites the question it does not answer. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Timur Tukaev <timur.tukaev@aenix.io>