A result's own security-severity score is banded like CVSS; without one,
the finding is graded by a hand-built CWE table; failing that, by its
SARIF level, one band lower than before. The scanners' levels said more
about the tool than about the risk: a container running as root came out
Critical and a hard-coded password Medium.
The summariser only reads security-severity off the rule, and Lynkeus
scores each result, so the runs are summarised here to keep that score.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
