Agent WranglersRules of engagement Required
Rank findings by harm
Give every finding a severity from how easy it is to use and how much harm it does. Fix the worst first.
How to do it
Use four levels. Critical means anyone can take data or control without logging in. High needs an account or one extra step. Medium needs unusual conditions. Low is a weakness without a known harm. A scoring system such as CVSS 4.0 can add detail.
Example
## Finding 3: Any logged-in user can read other orders
- Severity: High
- Proof: GET /api/orders/1002 with the token of the user who owns order 1001 returns 200
- Harm: Any customer can read the name and address on every order
- Fix: Check that the order belongs to the logged-in user before returning it
- Retest: Same request now returns 404How to check
Every finding has a severity, a proof, the harm in one sentence and a fix.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/rank-findings.