Make it optional to provide vulnerability severity

[tobie]

Closes #17.

[mrybczyn]

I feel uneasy with the severity being only a MAY. This is information people use to actually prioritize the work. I know very well that this is not mandatory in the CVE record for example, but requested frequently.

A SHOULD ?

A proposal:
SHOULD provide additional information like estimated severity, unique product identification and links to additional resources, if available.

[tobie]

@mrybczyn, I suggest discussing this in the original issue (#17) rather than opening a new thread here.

[mrybczyn]

I find it confusing to have a review of a merge request in both merge request and a related issue... Comments to the commit itself are typically given in a merge request, as it is in this case.

At this stage I disagree with this change.

[tobie]

Would 100% agree if the comment was editorial. Here it's substantive, though. You're not arguing for a change in the PR; you're arguing against the PR itself, hence my suggestion to continue the conversation where it started (and of course block the PR in the meantime here), but feel free to ignore my suggestion and continue the conversation here instead if that's what you prefer. I do suggest looping in the folks that commented in the issue here in that case.