Severity and Fix
Map findings to $PROGRAM severity rubric and suggest actionable fixes — defender-friendly closure.
Visual · t20_severity_and_fix
Severity = program rubric; fix = specific remediation hint. Original Cyberlium.
Pick severity from program docs, not ego — and give engineers a fix they can ship.
Bug bounty platforms publish severity matrices — read $PROGRAM rubric before assigning Critical/High/Medium/Low. Factors: auth required, data sensitivity, ease of exploitation, scope asset tier. Suggested fix: specific and actionable — 'enforce server-side ownership check on GET /api/v1/orders/{id}' beats 'use better security.' For XSS: encode output + CSP; IDOR: authZ middleware; SSRF: URL allowlist and block internal ranges; logic: validate state server-side. Accept triage may downgrade — respond professionally with additional minimal proof if asked, not rage comments. Cyberlium teaches rubric literacy on lab submissions — not arguing severity using stranger breach headlines as leverage.
1. Severity literacy
Quote rubric row that matches your finding — asset tier, auth, data class.
If between two levels, explain uncertainty; let triage decide — do not demand Critical.
Command guide
Try these commands — Severity literacy
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Impact + severity — align with program rubric CVSS optional — many programs use own scale
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq sudo apt install curl
macOS:
Command — copy this
brew install jq
Windows:
Command — copy this
choco install jq
Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
curl -sS 'https://httpbin.org/get?impact=literacy' | jq '.args' grep impact "$HOME/cyberlium-lab/t20-report-draft.txt" 2>/dev/null || printf 'impact: ' >> "$HOME/cyberlium-lab/t20-report-draft.txt"
Primary tools to practice this lesson: jq, curl. Reference sites: Impact + severity; CVSS optional. Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Fix suggestions
One primary fix + optional defense-in-depth — patch, config, monitor.
Avoid 'remove feature' unless no alternative — product teams need usable fixes.
3. Triage collaboration
Downgrade or duplicate responses: polite clarification, new minimal proof if needed — reputation asset.
N/A with explanation teaches you scope boundaries — update asset map, do not argue OOS.
4. What you ship: severity and fix block
Rubric citation row + suggested fix for one class + professional triage response template.
5. What you record before the next lesson
Severity and fix block path.
6. Wrong vs right: random sites vs in-scope program
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Mark missing X-Frame-Options OOS as Critical and insult triager.
- Right: Severity and fix block written. Next: Report Lab.
Mission: severity and fix block
1) Copy $PROGRAM rubric row format for lab. 2) Write fix for IDOR and XSS examples. 3) Draft polite downgrade response template. 4) chmod 600 notes.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Medium vs High on authenticated IDOR?”
APPLY: Severity should follow:
APPLY: True or False: Insulting triage helps escalation.
APPLY: Good fix suggestion is: