Awesome Reviewers

Verification · Finding validation

Severity scoring

Scores a finding from separate evidence axes (impact, persistence, detectability, reachability, scope, certainty) instead of a single guess.

Sub-techniques

  • Impact category V1046.001

    Data loss, security, crash, wrong behaviour, performance, leak or maintainability.

  • Persistence and detectability V1046.002

    Transient, until restart or permanent; loud, silent or delayed.

  • Blast radius V1046.003

    One operation, one user, a subset, broad or systemic.

  • Certainty basis V1046.004

    Demonstrated by a run, traced in code, inferred from a name, or assumed.

  • Standard vulnerability scoring V1046.005

    CVSS vectors, SSVC decisions and EPSS likelihood for security findings.

How to build it

  1. Have the reviewer fill each axis separately with evidence.
  2. Derive severity from the axes with a fixed table, never from free text.
  3. Cap severity when certainty is inferred or assumed.

Signals in a repository

  • Severity rubrics in review guidelines, or CVSS vectors in security advisories.