drift-security-triagelisted

# Drift Security Triage Skill ## Purpose Guide Copilot agents through consistent, policy-aligned triage of security reports for the drift repository. ## When to Use - Evaluating a new GitHub Security Advisory (GHSA) - Triaging a vulnerability report submitted via email or private advisory - Assessing Dependabot security alerts - Responding to CodeQL or detect-secrets findings ## Triage Workflow ### Step 1: Trust Model Check Drift operates under the **same trust level as local shell access**. Before classifying severity, determine: 1. **Does the vulnerability require prior write access to the target repository?** → If YES: likely **out of scope** (attacker already has equal privileges). 2. **Does drift execute any analyzed code?** → No. drift uses `ast.parse()` and tree-sitter for parsing — no code execution. 3. **Does drift make network requests?** → No. drift is fully local — no exfiltration vector exists. ### Step 2: Out-of-Scope Classification The following are explicitly NOT vulnerabilities in drift (see SECURITY.md): | Category | Reason | | --- | --- | | Malicious source files causing misleading findings | Same trust boundary — attacker already has write access | | Resource exhaustion on huge repositories | Operational concern, not a vulnerability | | Static analysis false positives | Signal quality issue — use false-positive template | | Secret-scanning baseline entries | Intentional test fixtures with non-reversible hashes | | Git history tamperin