No vulnerability correlation or deduplication

Mark commented

2026-05-10 16:07:14 +00:00

Owner

Closed: This feature belongs to a different project domain than redlens.

Original request: Request: CVE/exploit correlation engine for agent findings

Per triage review, this issue is misaligned with redlens's project scope. Please re-file against the appropriate project.

Closed: This feature belongs to a different project domain than redlens. **Original request:** Request: CVE/exploit correlation engine for agent findings Per triage review, this issue is misaligned with redlens's project scope. Please re-file against the appropriate project.

Mark added the

blocked:needs-decision

label

2026-05-12 23:26:21 +00:00

Mark commented

2026-05-13 11:50:43 +00:00

Author

Owner

Feature Triage Assessment

Scope: large
Risk: medium
Spec Alignment: misaligned
Summary: Request to add vulnerability correlation and deduplication to a React SPA starter template that has zero concept of 'findings' or vulnerabilities.
Recommendation: Close as not applicable — this issue appears to be filed against the wrong project. redlens is a React SPA starter (shadcn/ui, Vite, Tailwind) with no security-scanning subsystem. If vulnerability processing is needed, it would require building an entirely new domain model from scratch, which is out of scope for a UI scaffolding project.
Rationale: The codebase contains no references to findings, vulnerabilities, or security analysis — it's purely a React/TypeScript UI starter with shadcn/ui components, form handling, and charts. The issue's terminology ('findings', 'fingerprinting', 'deduplication') belongs to a SAST/security-scanning tool, not this project. Scope is 'large' because a vulnerability subsystem would need 15+ files (data models, correlation engine, UI components, state management), but the deeper issue is that it's fundamentally misaligned with the project's purpose.

Labeled blocked:needs-decision — unblock on Forgejo to dispatch to the fixer pipeline.

## Feature Triage Assessment **Scope:** large **Risk:** medium **Spec Alignment:** misaligned **Summary:** Request to add vulnerability correlation and deduplication to a React SPA starter template that has zero concept of 'findings' or vulnerabilities. **Recommendation:** Close as not applicable — this issue appears to be filed against the wrong project. redlens is a React SPA starter (shadcn/ui, Vite, Tailwind) with no security-scanning subsystem. If vulnerability processing is needed, it would require building an entirely new domain model from scratch, which is out of scope for a UI scaffolding project. **Rationale:** The codebase contains no references to findings, vulnerabilities, or security analysis — it's purely a React/TypeScript UI starter with shadcn/ui components, form handling, and charts. The issue's terminology ('findings', 'fingerprinting', 'deduplication') belongs to a SAST/security-scanning tool, not this project. Scope is 'large' because a vulnerability subsystem would need 15+ files (data models, correlation engine, UI components, state management), but the deeper issue is that it's fundamentally misaligned with the project's purpose. Labeled `blocked:needs-decision` — unblock on Forgejo to dispatch to the fixer pipeline.

Mark commented

2026-05-15 13:18:17 +00:00

Author

Owner

This issue describes security-scanning features (distributed scanning, vulnerability correlation, report generation) that belong to a vulnerability analysis tool, not a React SPA starter. redlens is explicitly a frontend UI scaffolding project — it has no scanning subsystem, no data pipeline, and no backend. Closing as filed against the wrong repository.

Mark closed this issue

2026-05-15 13:18:18 +00:00

Rows
Columns

No vulnerability correlation or deduplication #16

Feature Triage Assessment