S1SS
Score the finding the way defenders feel it.
Six dimensions, 10 points total. Harm and scale dominate; exploit difficulty matters least.
Harm Potential
What user, financial, privacy, safety or platform harm could result?
Scale
How many accounts, users, payments or surfaces could be affected?
Repeatability
How reliably can it be reproduced in the authorized environment?
Detection Resistance
Can the behavior persist without expected detection?
Barrier to Exploitation
How difficult is it for a realistic adversary to use?
Control Chain Impact
Does the finding defeat or degrade multiple defensive layers?
Bounty modifiers