Cvss Laravel Package

Product Decisions This Supports

• Severity as a product primitive. Every finding, ticket, or alert in a security-adjacent product needs a defensible severity. This library converts a CVSS vector string (e.g. CVSS:3.1/AV:N/AC:L/PR:N/...) into a numeric score and a qualitative band (None/Low/Medium/High/Critical). That single primitive sits underneath SLA clocks, auto-escalation, "fix Critical first" sorting, and customer-facing risk reports.
• Build vs. buy for scoring math. CVSS formulas are published, but they are easy to get subtly wrong — v3.1 changed rounding semantics (spec-level round-up), and scope-changed base formulas differ from scope-unchanged ones. A spec-following implementation is cheaper than reimplementing and re-validating, and it removes a class of bugs that auditors and customers will eventually find. Treat this as "adopt open source, own the wrapper."
• Roadmap enablement for severity-driven automation. Once scoring is a service call instead of a spreadsheet or a hardcoded branch, you can ship: severity-tiered SLAs, merge/deploy gates on unresolved Highs, routing and auto-assignment by severity, and per-customer risk thresholds.
• Triage UX and data quality. Parse and validate user-entered vectors, render metric dropdowns, generate the canonical vector string back, and show a per-metric score breakdown. This is the difference between a triage form people fill in correctly and one they game to hit a deadline.
• Environmental and temporal scoring per tenant. Enterprise customers want to re-weight confidentiality/integrity impact to their context. Supporting environmental metrics means you can offer contextual risk without building bespoke scoring per account.
• Disclosure and bug bounty workflows. Consistent scoring between researcher submission, triager adjustment, and published advisory prevents "the score changed after triage" disputes — a recurring source of friction in vulnerability disclosure programs.
• Interoperability and lossless import/export. Vector strings are the lingua franca between scanners (Trivy, Grype, Snyk), advisories (NVD, GHSA), and your product. Round-tripping vectors cleanly makes scanner imports and advisory exports reliable.
• Metrics this lets you report on: % of findings with a valid, canonical score; time-to-triage by severity; severity distribution drift release over release; SLA breach rate by band.

When to Consider This Package

Adopt when:

• You're on PHP/Laravel and need to compute or validate CVSS scores server-side.
• You accept vectors from users or third parties (bug bounty submissions, scanner imports, CSV uploads) and need validation plus canonicalization.
• You need CVSS v3.1 and/or v4.0 rather than one fixed formula.
• Score consistency across multiple services matters more than avoiding a dependency.
• You're prepared to own a thin adapter — this is a plain PHP library, not a Laravel package: no service provider, no config file, no facade. Budget a small wrapper (service binding, validation rule, value object).

Look elsewhere, or proceed with explicit diligence, when:

• You need exactly one fixed calculation in one place — a hardcoded value may suffice, though the v3.1 rounding rule is the classic trap.
• You need a full vulnerability management pipeline (dedupe, EPSS/KEV enrichment, asset mapping, workflow). This is a scoring primitive, not a platform.
• You require CVSS v2 legacy support, or vendor-backed support contracts and SLAs.
• You're not on PHP, or you need client-side scoring for instant UI feedback (you'd need a parallel JS implementation or a server round-trip).
• Adoption-risk tolerance is low. The repo shows minimal community signal in this snapshot (0 stars, 0 dependents). That's not disqualifying for a small, spec-bound computation library — the specification is the contract, not the star count — but it does mean: pin the version, vendor the dependency, and write your own conformance tests against the official CVSS spec example vectors before you bet a customer-facing SLA on it.

How to Pitch It (Stakeholders)

For executives: We're standardizing how we score vulnerability severity so prioritization, SLAs, and customer-facing reports all agree with each other. This is a small, free, standards-based library — CVSS is the industry-standard scoring system used by NVD and every major scanner. It replaces hand-rolled math with a specification-compliant implementation. Low cost, low risk, and it makes our severity claims defensible to customers and auditors while unblocking severity-driven automation on the roadmap.

For engineering: It's a focused PHP library that parses CVSS vector strings and returns base, temporal, and environmental scores plus severity bands for v3.1 (and v4.0). It's framework-agnostic, so we wrap it in a small Laravel service binding, a validation rule, and a CvssScore value object — roughly 1–2 days including conformance tests against the official spec examples. Two risks to name up front: low community adoption (mitigate by pinning the version, vendoring it, and owning our own test suite) and the absence of Laravel integration (a thin adapter is on us). In exchange, we stop shipping rounding bugs and scoring becomes a shared internal service consumed by triage, reporting, and SLA logic.