Repository navigation
AI-assisted H1 report triage #1858
Description
As discussed in #1826 and #1760, the Node.js security triage team is under significant strain from the flood of AI-generated HackerOne reports.
Some friends of mine at Konvu have a tool that directly addresses this: Konvu Community. It takes an incoming report (H1 integration), spins up the vulnerable environment on AWS, runs the described exploit, and returns a triage verdict.
They ran a few historical public reports through it and results were good.
There would be no cost as Konvu is funding it for OSS projects and is planning to work with OpenAI on sponsored credits for this.
I discussed this with @mcollina on Slack and he suggested I open this issue. @hedi-cmd and @reasoningsec from the Konvu team are happy to answer questions here or jump on a call.
Activity
vdeturckheim commentedon May 12, 2026
also, fwiw, I'm happy to pilot the PoC and handle interface with the Konvu team as much as needed
hedi-cmd commentedon May 12, 2026
Hi NodeJS team! Thanks for mentioning us @vdeturckheim - glad to help with your H1 reports triaging if you're considering an AI-assisted solution. Let me know if I can provide you with anything ahead of your meeting.
Cheers
RafaelGSS commentedon May 27, 2026
We were trying to build our own. Happy to chat, invite to work@rafaelgss.dev.
hedi-cmd commentedon May 27, 2026
Hi @RafaelGSS, sure! Would love to hear more about how you've been dealing with all this.
I just sent you an invite - added @vdeturckheim and @mcollina as well. Feel free to add more people and change the meeting time at your convenience!