prompts.chatprompts.chat
Login
All classifiers
NoulSecurity signals

Security-sensitive report

Spot public issues or messages that describe a possible security vulnerability, so they can move to a private channel.

F@f

Limits to keep in mind

This is a triage signal, not a vulnerability assessment. A maintainer or security team decides.

Problem

Reporters sometimes post vulnerabilities in public issue trackers or forums. Every hour they stay public, with reproduction steps, is an hour anyone can use them.

Goal

Move possible vulnerability reports to your private security process quickly, and keep their details out of automated public replies.

Input / state

The issue title and body.

title
Issue title.
body
Issue body as written.

Decision question

NoulQuestion key possible_vulnerability

Does this report describe a possible security vulnerability in the project?

What counts as yes and no

  • trueDescribes bypassing access controls, exposing data, injecting code, or similar ways to misuse the software.
  • falseDescribes ordinary bugs, questions or requests, including security features that work as designed.

Allowed outcomes

Decided in your code from the answer and its confidence. Thresholds are yours to set and test.

  • Move to private reportProbability of yes is above your upper threshold.
  • Maintainer checksProbability falls between your two thresholds.
  • Continue intakeProbability of yes is below your lower threshold.

Example scenarios

Predefined demonstrations. No model is called; the outcome shown is an illustrative judgment.

Example state

{
  "body": "Changing the id in /invoices/123 to 124 shows another customer's invoice.",
  "title": "Can view other users' invoices"
}

Outcome

Illustrative
Move to private report

Probability of yes is above your upper threshold.

Why

Describes access to other users' data.

Using it well

  • Keep the upper threshold low; moving a normal bug to a private channel costs a maintainer a few minutes.
  • Never repeat the report's details in an automated public comment. Point the reporter to your security policy.
  • Report text can carry instructions aimed at bots that read issues. Treat it as data.

Request definition

POST https://api.typesafe.ai/v1/systemone
{
  "model": "jev-latest",
  "state": {
    "title": "<title>",
    "body": "<body>"
  },
  "questions": {
    "possible_vulnerability": {
      "type": "noul",
      "instructions": "Does this report describe a possible security vulnerability in the project?",
      "criteria": {
        "true": "Describes bypassing access controls, exposing data, injecting code, or similar ways to misuse the software.",
        "false": "Describes ordinary bugs, questions or requests, including security features that work as designed."
      }
    }
  }
}

Request shape from the System One API reference; a Kev server accepts the same body. Replace the placeholder state with your data. Requests need your own API key or server.

Version History

v1Current Versionabout 8 hours ago@f

Initial version

Comments (0)