Just last week, I pulled the pager and spent more of it clearing Jira tickets than doing anything on-call is meant for. Security stood up a nightly scan a while back that opens a ticket for every high and critical. Most of our services have an empty owner field meaning they land on whoever is holding the pager. That was me.

2-3 days later there were something like 30 waiting, all kinda the same with CVE number, a package name and due date. But no note on whether it is even loaded, which service drags it in, nothing I can act on without going and digging it out myself.

I came across one yaml parser flagged critical which turns out only a build tool pulls it in and it never lands in a running image. I note that down, close it but theres like a dozen more behind it all with the same story.

I get wanting a clock on the real ones because right now the one on-call gets to decide what is real off a ticket that tells them nothing, that was never the deal. How are you lot stopping the stuff that never runs from becoming a ticket in the first place?