From 697bf79daf3fbe9ebcd82cf8808c9d30f435637a Mon Sep 17 00:00:00 2001 From: zocomputer Date: Wed, 12 Aug 2026 00:12:20 +0000 Subject: [PATCH] Fix test expectation: default reachability multiplier changed from requires_auth to externally_reachable MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The scoring code was updated to default to 'externally_reachable' (1.0) when no reachability tags are present. The previous default of 'requires_auth' (0.5) was deemed too penalizing, but the test expectation was not updated accordingly. 3.0 (LOW severity) × 0.7 (SANITIZATION_BYPASSABLE) × 1.0 (default) × 1.0 = 2.1 --- tests/test_scoring.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/test_scoring.py b/tests/test_scoring.py index c11e0f0..047d74e 100644 --- a/tests/test_scoring.py +++ b/tests/test_scoring.py @@ -92,7 +92,7 @@ def test_compute_exploitability_score_defaults_reachability_when_missing() -> No severity=Severity.LOW, evidence_level=EvidenceLevel.SANITIZATION_BYPASSABLE, ) - assert compute_exploitability_score(finding) == 1.05 + assert compute_exploitability_score(finding) == 2.1 def test_compute_exploitability_score_is_deterministic() -> None: