Verification · Finding validation · Severity scoring
Blast radius
One operation, one user, a subset, broad or systemic.
How to build it
- Record how many operations, users or subsets the defect affects.
- Rank scope as one operation, one user, a subset, broad or systemic.
- Use the scope rank in the severity table with the other axes.
Signals in a repository
- A severity rubric that lists scope levels from one operation to systemic.
- Finding templates with a scope field.
- Review comments that state how many users or requests a defect affects.
In practice
No scanned repository runs a tool for this check. The steps above are the only guidance.