qa-triagelisted

# QA Triage Bug triage state machine. Classify → score → route. ## Step 1 — Classify Assign exactly one classification to the bug: | Class | Definition | |---|---| | `regression` | Previously working behaviour that is now broken | | `new-defect` | Never worked correctly — bug in new code | | `performance` | Correct output but unacceptably slow | | `ux-degradation` | Works technically but creates a poor user experience | | `data-integrity` | Incorrect data stored, returned, or lost | | `security` | Potential data exposure, auth bypass, or injection | ## Step 2 — Priority Score Score on three axes (1–5 each): ``` Severity = how bad is the user impact when it happens? Frequency = how often does it occur? Blast = how many users / features does it affect? Score = Severity × Frequency × Blast ``` Priority mapping: | Score | Priority | |---|---| | 75–125 | P0 — drop everything | | 30–74 | P1 — fix this sprint | | 10–29 | P2 — fix next sprint | | 1–9 | P3 — backlog | **Severity floors — these override the score, never the other way round.** A multiplicative score under-rates the rare-but-catastrophic: a live auth bypass nobody has hit yet scores 5 × 1 × 5 = 25 and would otherwise land in P2. | Condition | Minimum priority | |---|---| | `security` — data exposure, auth bypass, injection | **P0** | | `data-integrity` — data incorrectly stored, returned, or lost | **P1** (P0 if the loss is unrecoverable) | | Production is down or the site cannot load | **P0** | Re