Severity and confidence

Severity is how bad this would be if it is real. Confidence is how sure we are that it is. Multiplying them together throws away the distinction that makes triage possible.

Severity

Confidence

Confidence runs from 0 to 1 where the check records it. For source verification, read it alongside the path, the source of untrusted input, and the guards that were checked. A dependency advisory, credential pattern, or maintainability observation has different evidence and should not be interpreted as an executed exploit.

A visible finding may still be unconfirmed or have no independent verification recorded. Confidence is not a runtime proof. Read the source evidence, the verification state, and the limitations of the check before deciding what to do.

Why they are separate

A critical finding at moderate confidence and a Watch finding at high confidence are different problems and want different responses. The first one you go and check, because if it is real it is the most important thing on your desk. The second one you schedule.

Collapsing both into a single score makes those two look identical, which is exactly the failure that trains teams to stop reading security reports.

Filtering by severity

cf reproduced --severity critical,high
cf reproduced --severity watch
cf reproduced --severity critical,high --exit-code

--exit-code exits 1 when any Critical or High finding is present, which is how you fail a CI job on it. See Running in CI.