No vulnerability correlation or deduplication

Mark commented

2026-05-10 16:09:04 +00:00

Owner

Closed: This feature belongs to a different project domain than redlens.

Original request: Request: Plugin-based reconnaissance module marketplace

Per triage review, this issue is misaligned with redlens's project scope. Please re-file against the appropriate project.

Closed: This feature belongs to a different project domain than redlens. **Original request:** Request: Plugin-based reconnaissance module marketplace Per triage review, this issue is misaligned with redlens's project scope. Please re-file against the appropriate project.

Mark added the

blocked:needs-decision

label

2026-05-12 23:26:19 +00:00

Mark commented

2026-05-13 02:30:52 +00:00

Author

Owner

Feature Triage Assessment

Scope: large
Risk: medium
Spec Alignment: misaligned
Summary: Wants to add finding fingerprinting and deduplication for vulnerability correlation.
Recommendation: This issue describes domain-specific logic (findings, vulnerabilities) that belongs in an application built on top of redlens, not in the starter kit itself. Redlens is a generic React SPA starter with empty sections/types directories and zero application logic. If building a vulnerability management app, start with domain models in app/src/types/ and incrementally add modules.
Rationale: SCOPE=large: There is no existing finding/vulnerability concept anywhere in the codebase — entire new subsystem needed (data model, fingerprinting algorithm, dedup logic, UI), easily 15+ files from scratch. RISK=medium: algorithms are straightforward but adding a full domain layer to a blank template carries architectural risk. SPEC=misaligned: redlens is explicitly a UI starter kit with shadcn/ui, Vite, Tailwind — the README, project structure, and all existing code confirm zero vulnerability-analysis features. This issue appears to have been filed against the wrong repository, or is requesting a feature that would first require building an entirely separate application.

Labeled blocked:needs-decision — unblock on Forgejo to dispatch to the fixer pipeline.

## Feature Triage Assessment **Scope:** large **Risk:** medium **Spec Alignment:** misaligned **Summary:** Wants to add finding fingerprinting and deduplication for vulnerability correlation. **Recommendation:** This issue describes domain-specific logic (findings, vulnerabilities) that belongs in an application built on top of redlens, not in the starter kit itself. Redlens is a generic React SPA starter with empty sections/types directories and zero application logic. If building a vulnerability management app, start with domain models in app/src/types/ and incrementally add modules. **Rationale:** SCOPE=large: There is no existing finding/vulnerability concept anywhere in the codebase — entire new subsystem needed (data model, fingerprinting algorithm, dedup logic, UI), easily 15+ files from scratch. RISK=medium: algorithms are straightforward but adding a full domain layer to a blank template carries architectural risk. SPEC=misaligned: redlens is explicitly a UI starter kit with shadcn/ui, Vite, Tailwind — the README, project structure, and all existing code confirm zero vulnerability-analysis features. This issue appears to have been filed against the wrong repository, or is requesting a feature that would first require building an entirely separate application. Labeled `blocked:needs-decision` — unblock on Forgejo to dispatch to the fixer pipeline.

Mark commented

2026-05-15 13:18:20 +00:00

Author

Owner

This issue describes security-scanning features (distributed scanning, vulnerability correlation, report generation) that belong to a vulnerability analysis tool, not a React SPA starter. redlens is explicitly a frontend UI scaffolding project — it has no scanning subsystem, no data pipeline, and no backend. Closing as filed against the wrong repository.

Mark closed this issue

2026-05-15 13:18:20 +00:00

Rows
Columns

No vulnerability correlation or deduplication #20

Feature Triage Assessment