What was found, and what it was worth

Two awards, kept separate

They are separate on purpose, and conflating them is how a bug programme dies.

The severity award

Scales with what was actually at risk, in four bands — A critical, B high, C normal, D low. Severity attaches to what is at risk, not to what the report claimed. A report is sometimes downgraded. It is also sometimes upgraded past what its author asked for, when the thing behind it turns out to be worse than they realised.

The quality award

Paid for work that makes a real finding better: a reproduction anyone can run, the line named, the impact sized honestly, a fix proposed, the sibling cases swept instead of stopping at the first one. It is what we pay when someone turns a thin report into one a developer can act on.

It is not paid for effort alone. A report we cannot reproduce, or one that describes intended behaviour, earns no award however much work went into it, and is not listed here. We say so in the forum thread and explain why, so the next report can be a better one.

A careful report that supplies what a thinner one left out can be worth more than the finding it attaches to.

Reports and findings are not the same thing

Some of these arrived as one report covering several faults, and were split on the forum into one topic per finding so each can be tracked and fixed on its own. Each finding below carries its own band; where it came from a larger report, the row says so and links to it.

The report itself gets no row. Counting it as a finding would inflate the totals, and the reports have already been split.

What reaches this page

Only findings that have been reproduced and taken up, which on the forum means they have been moved into a curated category. The open intake categories are where anyone can post, and much of what is there has not been reproduced yet — those are not listed here. A finding appears when it is confirmed, and not before.

How a status is decided

By probing the live network, not by reading a commit message. A fix that is merged, or deployed, or described as done in a thread, is none of it recorded here as fixed until the finding itself has been re-tested against what is actually running. Where that check disagrees with what was claimed, the status is corrected here and on the forum thread, so the reporter sees the correction in the place they filed it.

Two statuses were corrected that way on 21 September, both in the direction of admitting less progress than had been claimed. A bounty page that only ever moves toward "fixed" is not worth reading.