[All work](https://boiko.ai/work/)

Security tooling · Evidence-based triage · Created by [Andrii Boiko](https://boiko.ai/about/)

# sloptriage: Bug Report Reference Checks

sloptriage by Andrii Boiko checks code references in bug and security reports against repository versions, with evidence links and optional reproduction.

[Explore the repository](https://github.com/B0yko/sloptriage)

System map

## [Bring a report back to the source.](https://boiko.ai/work/sloptriage/#system-map-sloptriage)

1. Extract

   ### Code references

   Find cited files, lines, symbols, and stack frames in a report.

2. Verify

   ### Versioned source

   Resolve the relevant Git objects and check the references against them.

3. Review

   ### Maintainer evidence

   Return source-linked findings, with optional supported PoC reproduction.

Checks references and supported reproductions; it does not determine authorship or vulnerability validity.

## [Check the report against the code.](https://boiko.ai/work/sloptriage/#check-the-report-against-the-code)

A convincing bug report can cite a missing function, a line outside its file, or a stack frame that does not match the source. sloptriage extracts those references and checks them against the repository version the report names.

The CLI and GitHub Action produce findings with source permalinks, a JSON verdict, and optional issue comments and labels. Reporters can also run a preflight check before submitting. The tool leaves the decision to maintainers.

## [Resolve the version. Inspect the evidence.](https://boiko.ai/work/sloptriage/#resolve-the-version-inspect-the-evidence)

The reference checker uses deterministic extraction and tree-sitter definitions, without a language model. It reads Git objects directly and caches blob analysis in SQLite, so inspecting another release reuses unchanged code.

When a report has no usable version, the checker uses the default branch as of the report date and marks that assumption. Citations found in another indexed version remain visible as softer findings rather than hard failures.

[Reference-check design](https://github.com/B0yko/sloptriage/blob/9fe4a26dc496abd88953e2169594dc3999b08ef0/docs/how-it-works.md)

## [Reproduce only when requested.](https://boiko.ai/work/sloptriage/#reproduce-only-when-requested)

An optional reproduction path builds the selected commit and runs supported C, C++, Python, or shell proofs of concept in Docker or Podman. The execution container has no external network, a read-only root, an unprivileged user, and resource limits.

The GitHub workflow separates checking, reproduction, and posting results. A reproduced crash still needs human review: the container is the isolation boundary, and a malicious program can imitate crash output.

[Reproduction and its limits](https://github.com/B0yko/sloptriage/blob/9fe4a26dc496abd88953e2169594dc3999b08ef0/docs/repro.md)[Security model](https://github.com/B0yko/sloptriage/blob/9fe4a26dc496abd88953e2169594dc3999b08ef0/docs/security-model.md)

## [What the reference benchmark showed.](https://boiko.ai/work/sloptriage/#what-the-reference-benchmark-showed)

In the published curl evaluation, the checker flagged reference failures in 18 of 299 reports closed as not applicable, informative, or spam, and in one of 90 resolved reports. These are outcome labels from one project's report archive; they do not establish whether a report was AI-written.

The split was frozen before threshold selection, but evaluated twice. A fix between runs was partly informed by held-out failures, so the final results are not a pristine first-look estimate. Most reports in the first group still passed or lacked a decisive reference failure.

[Recorded reference-check results](https://github.com/B0yko/sloptriage/blob/9fe4a26dc496abd88953e2169594dc3999b08ef0/bench/results/2026-10-24.json)[Evaluation history and caveats](https://github.com/B0yko/sloptriage/blob/9fe4a26dc496abd88953e2169594dc3999b08ef0/README.md#results)

## [A useful check with a narrow remit.](https://boiko.ai/work/sloptriage/#a-useful-check-with-a-narrow-remit)

Correct citations do not establish that a vulnerability exists. Reports without concrete references offer little to check, and an assumed version can still differ from the one the reporter used.

The recorded reproduction run reproduced none of 17 selected proofs of concept from resolved curl reports; ten were unsupported as supplied. This measures the reproduction path's limits, not the validity of those reports. Broader reproduction support, another benchmark project, and duplicate detection remain planned.

[Recorded reproduction outcomes](https://github.com/B0yko/sloptriage/blob/9fe4a26dc496abd88953e2169594dc3999b08ef0/bench/results/repro-2026-10-24.json)[Benchmark methodology](https://github.com/B0yko/sloptriage/blob/9fe4a26dc496abd88953e2169594dc3999b08ef0/docs/bench.md)

## [Related work](https://boiko.ai/work/sloptriage/#related-work-heading)

- [go-public: auditing a repository before release](https://boiko.ai/work/go-public/)

- [agent-claimcheck: comparing claims with evidence](https://boiko.ai/work/agent-claimcheck/)

Author: [Andrii Boiko](https://boiko.ai/about/)

## Contact and profiles

- [Andrii Boiko on GitHub (B0yko)](https://github.com/B0yko)
- [Andrii Boiko on LinkedIn](https://www.linkedin.com/in/andriyboyko)
- [Andrii Boiko on Hugging Face](https://huggingface.co/aboiko)
- [Email](mailto:andrewvboyko@gmail.com)

Source: [https://boiko.ai/work/sloptriage/](https://boiko.ai/work/sloptriage/)