Triage the security advisory backlog (61 in triage)

[cliffhall]

Problem

Private vulnerability reporting is enabled on this repository, and reports have been accumulating while SECURITY.md told reporters the repo was not eligible for them. As of 2026-09-29 the repository's security advisories stand at:

State	Count
triage (never answered)	61
draft (accepted)	0
published	6
closed	2

#4870 rewrites SECURITY.md to match the enabled reporting and adds the security-advisory skill, which is the per-advisory procedure. This issue is the plan for working the existing backlog through it. It is not the triage itself.

⚠️ This is a public issue. Progress here is reported as aggregate counts only. No GHSA ids, summaries, affected servers per advisory, or reproduction details go in this issue, its comments, or any PR, commit message or branch name until the advisory in question is published.

Plan

1. Private inventory (read-only). List every triage advisory with its claimed severity and affected package, using the listing recipe in the security-advisory skill (step 1). Keep the output out of the repo and out of public text.
2. Scope pass. Sort each advisory into one of:
   • one of the seven servers under src/
   • a server moved to servers-archived (unmaintained; out of scope)
   • a third-party server (not ours)
   • an MCP SDK (route to the TypeScript or Python SDK's private advisory form, per the skill's step 2)
   • a duplicate of another advisory, or of one of the 6 already published
3. Order the in-scope work by reach. filesystem, git and fetch first (the skill's reach classes: path traversal, symlink escape, Roots bypass, argument injection, SSRF, robots bypass), then the other four servers. Within a server, cluster reports of the same class: several reports of one bug become one fix and one accepted advisory, and the rest close as duplicates of it.
4. Board each advisory when it is picked up, as a [GHSA-…] draft card in Incoming with a provisional Priority (the skill's step 1), a server's batch at a time, rather than 61 cards at once.
5. Verify and recommend. For each card, reproduce, confirm ownership, re-score, and hand a maintainer a private recommendation (accept, or close with which reason). Advisories have no comment API, so anything the reporter sees is posted by a maintainer in the UI.
6. Maintainers act. Accepting, closing, replying to reporters and publishing are human-only; agents never take them, singly or in bulk. Out-of-scope and SDK advisories close with a short reason so no reporter is left without an answer.
7. Fix accepted advisories through the skill's steps 4 to 6 (private fork, v2/main, release, publish, convert the card). A fix of real size gets its own card work; this issue does not collect fixes.
8. Report progress here as updated counts per state, plus how many were routed to an SDK and how many were out of scope.

Done when

• No advisory is left in triage without a board card and a recommendation.
• Every out-of-scope, duplicate and SDK advisory is closed by a maintainer with a reason.
• Every accepted advisory has a draft card moving through the board.

Related

• Agentic software factory Part 10: security-advisory skill; reconcile SECURITY.md with the advisory backlog #4870: security-advisory skill and the SECURITY.md rewrite (this plan's procedure)
• Tracker: Triage the open issue and PR backlog #4875: the open issue and PR backlog, a separate pass; its rule "never close a vulnerability report as a declined proposal" routes any report found there to this flow
• Agentic software factory Part 8: issue-triage skill and board audit, for community inflow #4868: issue-triage, whose Priority rubric and board audit apply once it lands