Verification · Finding validation · Severity scoring
Standard vulnerability scoring
CVSS vectors, SSVC decisions and EPSS likelihood for security findings.
How to build it
- Write a CVSS vector for each security finding from its base metrics.
- Record an SSVC decision for each finding that needs a response priority.
- Add an EPSS likelihood to the record when the issue has a published score.
Signals in a repository
- CVSS vector strings such as CVSS:3.1 or CVSS:4.0 in advisories or findings.
- SSVC decision records in the security triage files.
- A scoring script that uses a CVSS library to compute base scores.
In practice
No scanned repository runs a tool for this check. The steps above are the only guidance.