forkless/strix
1
0
Fork 0
mirror of https://github.com/usestrix/strix.git synced 2026-08-24 20:02:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

docs(reporting): drop 'one weakness per report' calibration bullet

Browse Source
This commit is contained in:
Alex Schapiro
2026-07-21 04:19:45 +00:00
parent 729debd915
commit 75a1173904
1 changed files with 0 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
strix/tools/reporting/tool.py
-3
View File
@@ -440,9 +440,6 @@ async def create_vulnerability_report(
user's data, a read-only information leak, or merely confirming user's data, a read-only information leak, or merely confirming
that an account / domain / software version *exists* (enumeration) that an account / domain / software version *exists* (enumeration)
is ``C:L`` (often ``I:N``) — not ``C:H``. is ``C:L`` (often ``I:N``) — not ``C:H``.
- **Score one weakness per report.** If the alarming impact depends
on chaining a second issue, report and score them separately rather
than folding the chained worst case into one inflated vector.
- **Model required position and interaction honestly.** An - **Model required position and interaction honestly.** An
adversary-in-the-middle prerequisite (e.g. cleartext transmission) adversary-in-the-middle prerequisite (e.g. cleartext transmission)
or a required victim action is not guaranteed — reflect it in or a required victim action is not guaranteed — reflect it in