​

Severity model

Severity describes impact. It does not describe the model’s confidence. A finding can be low severity with high confidence, or critical severity with lower confidence. Severity answers: “How bad would this be if it is real and ships to production?”

​

Severity levels

​

Severity vs confidence

Confidence is the model’s belief that the finding is valid. Severity is the impact if it is valid. Qodex keeps these separate so a finding can be filtered, sorted, and triaged by impact without hiding uncertainty.

​

Evidence guard

High and critical findings need stronger evidence. In interactive chat contexts, Qodex refuses to file some high-impact findings when the agent has not confirmed the page or response state after a failed visibility or verification check. This prevents a stale selector from becoming a false critical issue.

​

Security scenarios

Security testing uses inverted semantics: pass means the app blocked the attack, and fail means the app may be vulnerable. Severity for security findings reflects the impact of the successful attack. A BOLA issue on tenant data is high or critical because the impact is cross-user data exposure, even if the test itself is a simple request.

​

Related