mirror of
https://github.com/usestrix/strix.git
synced 2026-08-20 10:33:34 +02:00
alex s
ad27f0c67e
* docs(reporting): add CVSS calibration guidance to reduce severity inflation The create_vulnerability_report tool documents the cvss_breakdown format but gives no guidance on choosing metric values, so findings are frequently over-rated. Add a concise calibration block covering the most common inflation mistakes: scoring scenarios that presuppose the attacker already holds a stolen secret as unauthenticated (PR:N) criticals, using C:H/I:H for single-user or read-only/enumeration impact, folding a chained worst case into one vector, and ignoring adversary-in-the-middle or user-interaction prerequisites. * docs(reporting): drop 'one weakness per report' calibration bullet