What are the typical steps in triaging a Code Scanning alert?

• A. Checking the codebase for other alerts
• B. Verifying, reproducing if needed, assessing severity, assigning, and remediating before closing
• C. Ignoring the alert if it seems minor
• D. Closing the alert without action

Answer: (B)

Triaging a Code Scanning alert is about turning a potential issue into actionable work in a disciplined, verifiable way. Start by confirming the alert is real and not a false positive, checking the details the scanner provides and the relevant code context. If the information isn’t enough to decide, try to reproduce the issue in a safe environment to observe the vulnerability or defect firsthand. Once you have confirmation, assess the severity based on factors like impact, exploitability, and the assets or code paths involved to prioritize the remediation. Then assign the alert to the appropriate developer or team who has the right expertise and visibility to fix it, including all relevant context and evidence. Finally, remediate and verify the fix—re-run the scan or tests to ensure the issue is resolved—and close the alert with documentation of what was done and the outcome.

This approach ensures alerts are treated as real, prioritized accurately, tracked to ownership, and closed only after a verified fix, rather than being ignored or left unaddressed.