The original title is 10 words: "Let AI Triage Static-Analysis Alerts Without Letting It Hide Bugs"

Short summary

Using AI to triage static-analysis false positives is an authorization problem, not just a classification problem. The article prescribes a pipeline where the model proposes a verdict and cited evidence but never deletes findings; a deterministic policy or reviewer decides disposition with a time-bounded expiry. Suppressions are bound to scanner rule and source revision, auto-reopen on code changes, and are never auto-applied to security-critical categories like credentials, injection, or cryptography.

• •Keep detection and disposition separate: AI proposes, policy decides, findings are never deleted by the model
• •Bind suppressions to source revision and scanner rule; reopen on any relevant code change
• •Never auto-suppress security-critical findings; sample accepted suppressions and track reopen rate

Generated with AI, which can make mistakes.