Severity & CVSS scoring

When it applies

A finding is reproduced and you must put a number on it — for a report, a dispute, or triage. A defensible score gets paid/prioritised fairly; an inflated one gets you closed as N/A and hurts your credibility.

Why it works

CVSS decomposes severity into metrics you justify one at a time from what you proved, not what's theoretically possible. Grounding each metric in demonstrated impact makes the score arguable and consistent, and mapping it to the program's scale turns it into the right payout/priority.