Severity, confidence and domains
Three separate numbers, used together. Severity is impact, confidence is certainty, and the domain says what kind of problem it is.
Severity
| Severity | Read it as |
|---|---|
| CRITICAL | Someone can hurt you with this today. Stop and deal with it. |
| HIGH | A real path to harm that needs a little work or luck. |
| MEDIUM | Weakens your position; combine it with something else and it matters. |
| LOW | Worth tidying, no urgency. |
| INFO | Something you should know. Not a problem by itself. |
Confidence
A number between zero and one, set by the detector. A credential matched against a known provider pattern is near-certain; a variable that merely looks like a secret is not. Low confidence lowers a finding in the ranking rather than hiding it, and the reason is stated in the text.
Domains
- SECURITY
- Someone can do something they should not be able to do.
- PRIVACY
- Personal data going somewhere it was not meant to go.
- PERFORMANCE
- Work the application does that it does not need to do.
- COST_ABUSE
- A way for a stranger to spend your money - no rate limit, an open API.
- RELIABILITY
- Something simply broken in production, in front of users.
Rule types
Separately from severity, a rule declares what kind of thing it found: a VULNERABILITY, a SECURITY_CONFIGURATION, SECURITY_HARDENING, or a BEST_PRACTICE. It is how a missing hardening header is kept distinguishable from an exploitable hole.
Questions
Why is this only medium when another tool called it high?
Severity here is about impact on your application given what we know about it, not a fixed number per rule. The same missing header can be medium on a marketing page and high on an app that holds personal data.
Why show me low-confidence findings at all?
Because hiding them would be a silent decision made on your behalf. They are ranked down and the text says exactly what we could not establish.
Do you use CVSS?
Not as the primary scale. CVSS describes a vulnerability in the abstract; ranking here uses severity, confidence, domain and what the Application Brain knows about the affected code. Advisory findings still carry the upstream identifiers.
Something here wrong, missing or out of date? Tell us and we will fix the page.