Rate every finding on a fixed severity scale

How to do it

Without a fixed scale, one reviewer's "critical" is another's "minor", and the buyer cannot price the report. Define each level by what happens to the deal. A deal-breaker stops the deal or changes its price, such as code the company does not own or a live leak of customer data. Fix before closing covers a working secret in the history or an access hole. Fix within 90 days covers a missing backup test or an unpatched dependency with no known exploit. A note is a style or structure remark with no direct cost. Give every finding exactly one level, as Tie every finding to a rule ID and evidence asks. A finding on a Required rule starts at fix within 90 days or higher.

Examples

JavaScript example

const SEVERITIES = ['deal-breaker', 'fix-before-closing', 'fix-within-90-days', 'note']

function severityProblems(finding, ruleLevel) {
  const problems = []
  if (!SEVERITIES.includes(finding.severity)) problems.push(`${finding.id}: unknown severity "${finding.severity}"`)
  if (ruleLevel === 'Required' && finding.severity === 'note') problems.push(`${finding.id}: a Required rule is never a note`)
  return problems
}

Python example

SEVERITIES = ("deal-breaker", "fix-before-closing", "fix-within-90-days", "note")

def severity_problems(finding: dict, rule_level: str) -> list[str]:
    problems = []
    if finding["severity"] not in SEVERITIES:
        problems.append(f"{finding['id']}: unknown severity {finding['severity']!r}")
    if rule_level == "Required" and finding["severity"] == "note":
        problems.append(f"{finding['id']}: a Required rule is never a note")
    return problems

How to check

The report defines all four levels before its first finding. A script reads every finding and fails when one has no level, a level outside the four, or a Required rule rated as a note.

Related rules

• TDD-3 Tie every finding to a rule ID and evidence in Technical due diligence
• TDD-23 Run the buyer's checks on yourself before the review in Technical due diligence