Track Findings

Objective

Track findings from one sealed Codex Security scan as Linear issues, Jira issues, GitHub issues, or one draft GitHub security advisory. Do not change the scan bundle. Use one provider and one destination per run. Show the exact payload and get approval before writing.

GitHub advisory mode creates one private draft in the verified public canonical source repository through authenticated gh api --hostname github.com. Read references/github-security-advisories.md in full before advisory work.

Jira mode uses Atlassian Rovo to create, reuse, or update one Jira Cloud issue per selected finding. Use it for one finding or an explicitly selected batch of up to 25. Read references/jira.md in full before Jira work.

Resources

The tracking helper is at the plugin root:

• scripts/validate_tracking_source.py

This skill lives at <plugin-root>/skills/track-findings/SKILL.md, so <plugin-root> is two directories up. Do not look for the helper inside the skill directory.

GitHub advisory mode is defined in: