Verification · Finding validation · Severity scoring
Certainty basis
Demonstrated by a run, traced in code, inferred from a name, or assumed.
How to build it
- Record how each finding was checked: run, traced in code, inferred or assumed.
- Cap the severity of inferred or assumed findings below demonstrated ones.
- Ask the author for a run or trace before a finding is raised above its cap.
Signals in a repository
- A certainty field in finding records with the values run, traced, inferred or assumed.
- Review comments that attach a reproduction or test run as evidence.
- A rubric that caps severity by certainty basis.
In practice
No scanned repository runs a tool for this check. The steps above are the only guidance.