Severity
A finding does not carry a severity rating. It carries a trace, and severity is a published, versioned formula over what tier 1 verifies about that trace. No component reads an impact statement to decide what a finding is worth, so there is no self-reported vector to inflate and no judgment to steer.
Rejected: self-reported CVSS (legible to everyone, gameable by anyone; vectors trend high); severity proposed by the claimant and adjusted by validators with stake exposed (still takes a claimed number; the adjustment needs a judgment component, which would then set the largest multiplier on the award; and it has to be bidirectional with sliced awards or understate-then-upgrade across two identities mints a validation award).
Inputs
| Input | Derived from | When tier 1 cannot verify it |
|---|---|---|
| Root class | A published table of trace roots: a listener or route registration is network, argv or a config file is local | Internal, the lowest class |
| Privileges on the path | A published table of auth-check patterns; tier 1 walks the path and reports which it crosses | Any check found on the path counts. A path that avoids it is a different trace |
| Sink class | A published table mapping sinks to vulnerability class and base impact: exec and eval to code execution, a tainted index to memory corruption, a query builder to injection, an output sink fed from a secret source to disclosure. Data flow must show taint reaching the dangerous argument | Lowest impact |
| Reach | Dependents, measured from the package registry (deps.dev in season 0, cached per package per day) | Never defaulted; measured |
Everything unverifiable defaults low. The trace must start where the attacker starts: a claimant who wants network severity extends the verified trace back to the socket, and a longer trace has more places to fail. Chased to the limit, agents look for the worst path they can prove, which is the job. The impact statement stays as documentation for the humans who carry the finding upstream and scores nothing.
The formula
Published and versioned like the metric. Its shape: the sink class supplies a base impact; root class and privileges scale it for who can reach the sink and from where; reach scales the award for how many dependents inherit the flaw. Levels and scales are provisional. Whatever the version, the formula is monotone in every input, defaults every unverifiable input lowest, and scores a root or sink not yet in a table at the lowest level. That last property under-rewards the first finding of a new class until a table version adds it, an accepted cost: the alternative is a judgment component deciding what new things are worth.
The tables
Per language and framework; a governance surface, versioned, judged by the version in force at posting. The formula is deliberately coarse, with no user-interaction or scope terms: add rows to the tables before adding terms to the formula.
Slices
The award at a finding's standing severity is minted once and sliced by level, each slice belonging to whoever established that level. A verified trace extension that raises severity is a validation and earns the difference. A successful severity refutation reverses the top slice and transfers the matching stake; the finding stands at the lower level. Understating and then upgrading across two identities nets the pair exactly the honest total, which is the invariant again.
Severity disputes
Every input is a trace property, so most severity disputes are statically decidable: "the root is not network-exposed" and "an auth check sits on this path" settle in tier 1. A severity refutation names the trace property it attacks and stakes as the narrower move it is. "The impact is unsupported" is either a severity refutation naming a trace property or a statement about the impact statement, which scores nothing. What remains for the ladder is the soundness gap, a trace that is real but not exploitable in practice, which refutation of the finding owns.
Presentation
A CVSS-shaped label for downstream readers is probably worth publishing, as a presentation layer over the formula and never an input to it.
Open
- The tables, version 0, per language and framework, with an owner and a review path.
- Levels and scales (parameters.md).
- Novel-class under-reward. Revisit if it visibly suppresses reports of new classes.
- The CVSS-shaped label. Decide, and define as presentation only.