AN OSS SCAN THAT YOU CAN ACT ON

1. Read eligibility criteria and confirm you are a core maintainer with capacity to triage findings.
2. Start from the official project template. Prepare the repository URL, primary contact and a Dockerfile that builds the audit environment.
3. Document the threat model: exposed inputs, important assets, areas in scope and how to reproduce a meaningful issue.
4. Run the repository's configuration validator and build the Dockerfile locally. Confirm the test suite works in that environment.

1. Reproduce the claimed behavior in a controlled test. Record the affected revision and prerequisites.
2. Separate confirmed vulnerabilities, duplicates and false positives. Assign an owner and add a regression test to the fix.
3. Use the project's disclosure process for confirmed issues. Keep unvalidated claims out of public incident statements.

Repository: __________
Maintainer/contact: __________
Build environment: __________
Threat model location: __________
Triage owner and review date: __________