Prioritize real risk

Not every possible weakness deserves the same response. We have limited time, so priorities matter.

Risk is not a feeling. For each weakness, estimate four things: how reachable it is, what an attacker gains, how many users are affected, and how hard recovery would be. Then fix easy, high-impact exposure first.

Compare two findings

Take two findings from the same notes app:

finding A: public note export endpoint has no ownership check
  reachable:  today, by any signed-in user with curl
  gain:       every draft in the database
  affected:   all accounts
  recovery:   painful — we cannot un-leak data

finding B: notes may persist in a server-side cache after deletion
  reachable:  requires server access first
  gain:       fragments of recently deleted notes
  affected:   some accounts
  recovery:   flush the cache

Both sound alarming in a report. But finding A is reachable today by anyone with an account, while finding B requires the attacker to already be on your server — and if they are, you have a bigger incident than the cache. A gets fixed this week. B goes on the backlog with a note.

Record assumptions, not scores

Teams like numeric scores because they look objective. Exact-looking scores can hide weak assumptions: a “7.4” says nothing about why, and it goes stale silently.

Keep the ranking comparative and write down what you assumed:

rank 1: export endpoint  — assumes the endpoint is enabled in production
rank 2: cache leak       — assumes attackers lack server access
reorder trigger: any sign of server compromise

That last line is the useful part. It records what evidence would make the priority change, so the ranking updates when reality does instead of when someone happens to remember it.

The failure mode

The common mistake is fixing whatever was reported most recently, or whatever a scanner painted red. A week spent on a theoretical issue is a week the reachable one stayed open.

Rank three risks from your own project using the four questions. Attach one piece of evidence to the top one — a request, a log line, a config value. Then change one assumption and check whether the order changes. If nothing ever changes it, your ranking is decoration.