Fix Queue: dedupe, reproduce and rank AI-found bugs, now that Postgres slipped a release

Deduplication and hallucination checks are already being commoditized. GitHub is building them into private vulnerability reporting, SlopGuard does the static grounding checks for free, and HackerOne covers its own programs. A new entrant that sells only clustering and a plausibility label risks being overtaken by a GitHub release. The step nobody has productized is the one that matters most to maintainers: safely running the reporter's proof of concept in a sandbox against the vulnerable and fixed versions and returning a reproduced or not-reproduced verdict. Maintainers already treat "I have a failing test" as the point where they accept a report. Elastic does this in-house, and the PHP Foundation warns that running untrusted proofs of concept locally is dangerous, so there is real demand for a hosted, isolated runner that maintainers trust. Two other openings exist. One is merging intake across channels (GitHub advisories, email, HackerOne, huntr, scanner output) into one queue, since GitHub's tooling will stay GitHub-only. The other is sharing duplicate and slop signals across many repos so known bad actors and mass-filed findings get flagged across an ecosystem. The main risks are that small maintainers don't pay, and that Alpha-Omega/OpenSSF money or GitHub could fund free versions. The more likely paying customers are companies running open-source program offices (OSPOs) and foundations that triage on behalf of many projects. Partnering with or applying for the Alpha-Omega grants may be better than competing with them.

• GitHub native private vulnerability reporting (planned AI triage, structured forms, rate limits)

  In March 2026 GitHub said it was exploring AI-assisted triage for private vulnerability reports. The plan covers duplicate and similarity checks against the Advisory Database, spotting reports that cite code the repo doesn't contain, and checking scope against SECURITY.md. Structured report forms with a required proof of concept and daily rate limits on reports have already shipped. I found no changelog entry confirming the AI triage has shipped. This is the biggest platform risk.

• SlopGuard (open source)

  The closest direct match. It's a triage layer for maintainers flooded with AI-generated security reports. It takes reports through a GitHub App, a GitLab webhook, a Maildir watcher or the command line. Static checks confirm that cited files, lines and symbols exist and look for near-duplicates of GHSA/NVD entries. An optional LLM pass then labels each report plausible, implausible or undetermined. It does not run the proof of concept in a sandbox.

• HackerOne Hai Triage

  HackerOne's AI-plus-human triage, launched in 2025, filters AI-generated submissions before a human analyst sees them. It only covers programs run on HackerOne, so it doesn't reach maintainers using GitHub advisories or email.

• Elastic in-house AI triage pipeline

  An internal multi-stage LLM pipeline with adversarial review. When a report warrants it, Elastic reproduces it on throwaway sandbox VMs. It isn't a product, but it shows that large vendors build this workflow themselves.

• OpenSSF / Alpha-Omega $12.5M AI-report triage funding

  Anthropic, AWS, GitHub, Google, Microsoft and OpenAI are funding this to help maintainers triage and fix the flood of AI-found vulnerabilities. AWS has promised tools that validate real bugs and filter out low-quality ones. No named tool yet, but it could produce a free competitor aimed at the same maintainers.

• Exploit Arena

  A hackathon project. AI agents write proofs of concept in sandboxes, and separate verifier agents reproduce them and score severity. It shows that sandboxed reproduction is technically feasible, but it isn't a maintainer inbox.

Checked 2026-10-09