A CVE triage pipeline that keeps asking, because day one tells you nothing
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
A developer's write-up describes "Rappaport," an open-source CVE triage pipeline that keeps priority decisions in deterministic code, treating the language model as the least-trusted component with no authority over rankings.