Severity rubric

Product impact, not analysis drama.

Every audit finding is assigned one of four severity levels under this published rubric. Severity reflects product impact — not how strongly the analysis feels. Severity chips on the Mapparoo site link here. A guide — hosted or downloaded — carries these definitions inside it, so it reads the same offline.

Decide now

A core product promise fails, data loss is exposed, a security issue is plausibly exploitable, or launch is blocked.

Examples

  • Payment confirmation is missing — customers can pay and receive nothing.
  • Authentication bypass is plausibly reachable from the shipped code paths.
  • A data-deletion promise in the plan has no implementation in the repository.
  • A launch-blocking dependency is absent with no fallback path.

Follow up

Real product risk or meaningful divergence that should be addressed before you scale, ship broadly, or hand off — but not an immediate stop-ship.

Examples

  • Email notifications are present but unverified — no evidence they execute in practice.
  • An admin-only feature in the plan is implemented without the promised access controls.
  • Observed behavior diverges from the plan in a way users would notice, but core flows still operate.

Housekeeping

Hygiene, consistency, or maintainability issues that matter over time but do not block the product today.

Examples

  • Duplicate implementations of the same utility across modules.
  • Plan references a configuration pattern the build uses differently but equivalently.
  • Documentation drift — the plan describes a flow the code handles via a different but acceptable path.

Evidence supports the plan

Supporting evidence — the audit reports agreement as diligently as divergence. Each supporting finding names the verification tier that supports it.

Examples

  • Password reset flow: planned, found, verified to tier 2 with tests executed.
  • Core navigation structure matches the plan with pinned document and code references.
  • Declared environment variables are present and referenced consistently in the build.

Severity is assigned consistently across runs. Findings are recommendations — acting on one, or declining to, is entirely your decision.