Style and severity
How we write, and what the severity words mean. The sample report uses the same words as this page.
Voice
Write like the report will be read in an incident. Short sentences. Specific nouns. The reader is a tired engineer or a counsel who will be quoted.
Name the assumption. Every finding states the belief that made the bug possible, because the fix is usually to the belief, not to the line. Prefer “we missed this class last year; here is the rule we added” over swagger.
Second person to the buyer. First person plural for the firm. No exclamation marks in chrome. Errors are factual: “Email is missing.” Empty states say what is missing and what will fill it.
Words we do not use
These do not appear on this site or in a report. If one slips in, it is a bug.
- AI-powered
- comprehensive
- end-to-end
- cutting-edge
- trusted by
- zero complacency
- battle-tested
- seamless
- robust (as praise)
- best-in-class
- Oops
- Get started
Also absent: invented TVL, finding counts we have not earned, client names without clearance, testimonials, headcount, accreditation badges, and lorem ipsum.
Severity
Use the words, not color alone. Color is an 8px tick in Paper chrome, never colored type on a dark ground, never a pill.
- Critical
- Funds or safety, exploitable as scoped. An attacker with the access the threat model grants can take value or break a safety property now.
- High
- Serious, less immediate than critical. Exploitable with a precondition that is realistic but not free: a specific role, a market state, a second bug.
- Medium
- Bounded loss or a broken assumption that does not yet have an exploit path in scope. Fix before the next release.
- Low
- Defense in depth. No direct loss path today; removes a step from a future one.
- Informational
- An observation with no security impact as scoped. Hygiene, clarity, or a note for the next reviewer.
How we write a finding
Every finding has the same five parts, in this order.
- Title. Severity word, then what is wrong, in one line. “High — Agent signer has no named principal.”
- Where. File, function, contract, tool, or pipeline stage. A reader can open it.
- Path. The exploit path we took, or the path that failed and why. Reproducible from the report alone.
- Assumption. The belief in the brief or in the code that made the path possible. This is what the fix should change.
- Fix and retest. What we recommend, what you shipped, and whether it held on retest.
Specimen. The three type faces as they appear on this site.
We audit the joins.
The vault can be correct and the agent still transfers. The model that picks the call is not the principal that holds the key.
invariant transfer preserves sum(balances) severity lake critical slug sample-join-review