Security tool
Catch fabricated vulnerability reports before you triage them
AI-generated bug bounty and vulnerability reports increasingly cite file paths, line numbers, and function names that don't exist. TriageShield checks every concrete claim against the repo's real current state — mechanically, with no LLM judging the verdict.
Public repos only. Checks file, line, and function claims against the repo's real current default branch.
Frequently asked
Does this use an LLM to judge the report?
No. The verdict path is entirely mechanical: it extracts concrete claims (file paths, line numbers, function names) from the report text with pattern matching, then checks each one against the repo's real current tree and file contents via the GitHub API. Same input always produces the same verdict.
What does it actually catch?
The lazy, high-volume pattern behind most AI-slop reports: citing a file that doesn't exist, a line number past the end of the file, or a function name that isn't anywhere in the referenced file. curl's own maintainers have said roughly 20% of AI-generated reports cite non-existent specifics like this.
What can't it catch?
A well-written fabrication with no concrete pointers, or a real bug described only in vague terms. This is a fast mechanical filter for the laziest fabrications, not a substitute for human review of every report.
Does it work on private repos?
The free check only works on public GitHub repos, since it reads the tree and file contents through GitHub's public API. The Team plan supports a GitHub token for private-repo access.