Broad, severe compromise
For example, reliable unauthenticated code execution giving broad control over a sensitive production system. The report must establish the actual conditions and impact.
RISK / SEVERITY GUIDE
A name isn’t a rating.
Impact makes the difference.
XSS, SQL injection, and RCE describe weakness types. Severity depends on what can actually happen in your application, under the conditions tested.
Evidence before labels.
We consider required access, attacker prerequisites, reliability, affected data, scope of control, and business context. Examples below are illustrative; they are not automatic ratings for every bug of that type.
Substantial access or exposure
For example, a customer can read other customers’ private invoices across an application boundary. Extent and data sensitivity determine the final rating.
Meaningful impact with constraints
A weakness can affect a protected action, but requires specific access, interaction, or other limiting conditions. Those prerequisites belong in the report.
Limited demonstrated impact
A validated weakness with narrow reach or low-sensitivity exposure. A low rating still needs a clear explanation of what is affected.
Useful observation
A hardening recommendation or observation without demonstrated security impact in the assessed scope. It is distinguished from a confirmed vulnerability.
PRICING / AGREED IN ADVANCE
Severity informs the discussion.
It doesn’t create a surprise bill.
The initial check is $10 USD regardless of findings. Additional qualifying critical-finding fees start at $100. Eligibility, severity criteria, fee tiers, duplicate handling, and a maximum charge are agreed before testing. This guide is not a price list for each severity level.
If CVSS is used, the report includes the version, vector, and rationale. A technical severity score is one input to the risk discussion; it does not automatically determine a fee.
See an illustrative finding ↗Reference: FIRST CVSS v4.0 specification. This page uses plain-language examples, not a substitute scoring system.