News for hackers. Stuff that matters.
Re:“Yes, you should test on production” – Why developer expe... by datadrivenangel on Monday August 14, 2023 @08:24AM (#37120224)
Severity should include detectability. If you never detect an issue, it's not an issue because nobody sees it.
Re:“Yes, you should test on production” – Why developer expe... by hef19898 on Monday August 14, 2023 @09:52AM (#37121030)
Usually it is a seperate factor, at least as far as P/D-MEAs are concerned. Quick and dirty, sure, it can be included in severity. Personally, I prefer the increased transparency and granularity of having detectability as a different factor.