feat(security): prioritize findings by normalized severity - #350

@Subodh-17 is attempting to deploy a commit to the Srijan Jaiswal's projects Team on Vercel.

A member of the Team first needs to authorize it.

🎉 Thank you @Subodh-17 for submitting a Pull Request!

We're excited to review your contribution.

✅ Before Review

• Ensure all CI checks pass.
• Complete the PR template.
• Link the related issue.

⚡ Want faster reviews and contributor support?

Join our Discord community:

🔗 https://discord.gg/FcXuyw2Rs

Maintainers and mentors are active there and can help resolve blockers quickly.

Happy Contributing! 🚀

@Subodh-17 The PR LGTM but there are a couple of changes needed -

1. Add severity_score to the README, docs or CHANGELOG, and to ml_score’s neighbours in ARCHITECTURE.md and the frontend finding type.
2. Make cvss a hard import, pin cvss>=3.0, and drop the silent fallback.
3. Delete _prioritize_findings and the 15-tuple branch in create_findings.
4. Replace the two tautological DB tests with the real-init_db() one.
5. Confirm that Gitleaks actually emits Confidence. If it doesn’t, either derive a score from rule or entropy, or document that secrets default to 5.0.
6. Fix failing lint check

Hi, I’ve pushed the six requested review fixes to PR #350 in commit bb027f26a1b7e94e81968d5813eab93b40619664.

The updated code passes my local validation: 147 backend tests, Ruff lint/format checks, and the frontend production build.

The Backend Quality Gates and CI workflows are currently awaiting approval for the fork PR. The triage-and-label check is blocked by the upstream pull_request_target checkout restriction, and Vercel requires team authorization.

Could you please approve the pending CI workflows and review the updated commit when convenient? Thanks!

Thanks @Subodh-17, I re-reviewed the updated commit (bb027f2) against #329 and the earlier feedback.

Verified on the PR branch:

• Full backend suite passes (147 tests), including the severity ranker tests
• ruff check and ruff format --check are clean

Previous feedback is addressed:

• Gitleaks now uses Entropy, since v8 doesn't emit Confidence, so secrets no longer all fall back to 5.0. Confidence is still honoured if present.
• cvss is a hard import and pinned to cvss>=3.0
• severity_score is added to README, ARCHITECTURE.md, CHANGELOG and the frontend types/mapper
• Dead code removed (_prioritize_findings, the 15-column insert branch)
• Redundant DB tests replaced by the real init_db() migration test

Two small issues in the secret scoring. Neither blocks the merge, but they're worth a quick follow-up:

1. The high-impact rule check (aws, private-key, etc.) only runs when no entropy is present. Gitleaks always emits Entropy, so that branch is effectively unreachable. A real AWS key with entropy ~3 scores 6.0, and one with entropy 2.0 scores 4.0, instead of 8.0. Please check the rule name before the entropy tiers.
2. The "aws" substring match also hits unrelated rules, e.g. laws-token scores 8.0. Matching on aws- or on exact rule IDs would avoid that.

The entropy and rule heuristics go beyond the literal Gitleaks Confidence mapping in the issue. I think that's justified, but it's worth the maintainer knowing.

Otherwise this looks good to me.

Hi @ionfwsrijan,

I’ve pushed the follow-up fixes for the secret-scoring issues to PR #350 in commit c1250c89a5f4a8ee7788e8fa6e4a7302fc850c45.

The fixes address:

1. High-impact secret rules being evaluated before entropy thresholds.
2. Boundary-aware AWS rule matching to avoid false positives such as laws-token.
3. Explicit rule-identifier matching so incidental title text cannot trigger high-impact scores.
4. Regression tests covering these cases.

Local validation reports 153 backend tests passing, with Ruff lint and formatting checks clean.

The Backend Quality Gates and CI workflows currently show action_required for this fork PR. Could you please approve and run the pending workflows when convenient?

Thank you!

@Subodh-17 The PR looks good to me. Thanks for your contrubution. Make sure to star the repo and follow me.