Security has CVEs. Abuse deserves a standard too.
Four building blocks make abuse findings comparable across companies: a canonical identifier, a weakness taxonomy, a severity score, and outcome tags that separate the failed control from the harm it enables.
S1AV — Abuse Vulnerability
The canonical identifier for a validated weakness in a fraud, scam, Trust & Safety or abuse-prevention control. Format S1AV-YYYY-NNNNN, for example S1AV-2027-00482.
S1WE — Weakness Enumeration
Ten top-level categories covering the defensive surfaces where abuse actually lands.
S1SS — Severity Score
A 0.0–10.0 score weighted for fraud and abuse impact rather than software exploitability.
Harm Potential
max 3What user, financial, privacy, safety or platform harm could result?
Scale
max 2How many accounts, users, payments or surfaces could be affected?
Repeatability
max 2How reliably can it be reproduced in the authorized environment?
Detection Resistance
max 1Can the behavior persist without expected detection?
Barrier to Exploitation
max 1How difficult is it for a realistic adversary to use?
Control Chain Impact
max 1Does the finding defeat or degrade multiple defensive layers?