Severity

Severity says how much a finding matters. It combines two sub-ratings, impact and likelihood, and ranges from Info to Critical. Impact reflects the consequences the issue has for the system; likelihood reflects the probability of it occurring. The two map to the final severity through a fixed matrix published in every report.

Warning and Info sit outside the likelihood-rated levels: Warning marks an issue that could become a security vulnerability if the code or configuration changed, and Info marks an issue on the borderline between code quality and security. Every finding states its impact and likelihood alongside the resulting severity.