# MobileAudit Severity Levels Explained: Critical, High, Medium, Low, and None

> Understand MobileAudit severity levels Critical High Medium Low and None for classifying security findings. Learn how this Django TextChoices enumeration standardizes vulnerability reports.

- Repository: [Mónica Pastor/mobileaudit](https://github.com/mpast/mobileaudit)
- Tags: deep-dive
- Published: 2026-03-07

---

**MobileAudit uses a Django `TextChoices` enumeration named `Severity` with five values—Critical (CR), High (HI), Medium (ME), Low (LO), and None (NO)—to standardize the classification of security findings across the platform.**

The open-source mobile security scanner MobileAudit categorizes every vulnerability using a standardized severity taxonomy. This system, implemented in the Django backend of the `mpast/mobileaudit` repository, ensures consistent risk assessment across scan results, dashboard visualizations, and compliance reports. Understanding these severity levels is essential for prioritizing remediation efforts and interpreting scan output.

## The Severity Enumeration in app/models.py

The severity classification system is defined in [`app/models.py`](https://github.com/mpast/mobileaudit/blob/main/app/models.py) as a **Django `TextChoices` enumeration** called `Severity`. This class maps internal two-letter codes to human-readable labels:

- **Critical** (`CR`)
- **High** (`HI`)
- **Medium** (`ME`)
- **Low** (`LO`)
- **None** (`NO`)

According to the MobileAudit source code, the `Severity` choices are attached to the `Finding.severity` field and other models such as `Pattern`, `PermissionType`, and `Permission` via the `choices=Severity.choices` parameter. This guarantees that only these five standardized values can be stored in the database.

## Aggregating Findings by Severity in app/views.py

When processing scan results, MobileAudit aggregates vulnerability counts using the helper function **`get_findings_by_severity`**. Located in [`app/views.py`](https://github.com/mpast/mobileaudit/blob/main/app/views.py), this function queries the database and returns a dictionary mapping each severity label to its occurrence count:

```python
def get_findings_by_severity(scan_id):
    return {
        'Critical': Finding.objects.filter(scan=scan_id, severity=Severity.CR).count(),
        'High':     Finding.objects.filter(scan=scan_id, severity=Severity.HI).count(),
        'Medium':   Finding.objects.filter(scan=scan_id, severity=Severity.ME).count(),
        'Low':      Finding.objects.filter(scan=scan_id, severity=Severity.LO).count(),
        'None':     Finding.objects.filter(scan=scan_id, severity=Severity.NO).count(),
    }

```

These aggregated totals drive the dashboard widgets and export reports, providing security teams with immediate visibility into risk distribution.

## Working with MobileAudit Severity Levels: Code Examples

### Creating a Finding with a Specific Severity

To programmatically create a finding and assign a severity level, import the `Severity` enumeration and specify the appropriate constant:

```python
from app.models import Finding, Pattern, Scan, Severity

scan = Scan.objects.get(id=1)
pattern = Pattern.objects.get(id=42)

finding = Finding.objects.create(
    scan=scan,
    type=pattern,
    name='Insecure HTTP URL',
    path='src/com/example/MainActivity.java',
    line_number=27,
    line='String url = "http://example.com";',
    snippet='http://example.com',
    description='Uses clear-text HTTP.',
    severity=Severity.HI,  # High severity

    status='VF',
    user=request.user,
)

```

### Filtering Findings by Severity Level

Retrieve all findings matching a specific severity using Django's ORM filter method:

```python
from app.models import Finding, Severity

# Get all high-severity findings for a specific scan

high_findings = Finding.objects.filter(scan=scan_id, severity=Severity.HI)

```

### Generating Severity Summary Reports

Reuse the dashboard aggregation logic to generate executive summaries:

```python
from app.views import get_findings_by_severity

summary = get_findings_by_severity(scan_id=42)

# Returns: {'Critical': 2, 'High': 5, 'Medium': 12, 'Low': 8, 'None': 3}

```

### Displaying Severity Labels in Templates

Render the human-readable severity label in Django templates using the built-in `get_FOO_display` method:

```django
{{ finding.get_severity_display }}

```

## Database Schema and Migration Support

The severity taxonomy is enforced at the database level through Django migrations. The initial migration in [`app/migrations/0001_initial.py`](https://github.com/mpast/mobileaudit/blob/main/app/migrations/0001_initial.py) creates the database column with the same five choices, ensuring data integrity across PostgreSQL or SQLite backends. This schema-level constraint prevents invalid severity values from entering the system regardless of the interface used to create findings.

## Summary

- MobileAudit defines five severity levels—**Critical**, **High**, **Medium**, **Low**, and **None**—using the `Severity` `TextChoices` enumeration in [`app/models.py`](https://github.com/mpast/mobileaudit/blob/main/app/models.py).
- The **`get_findings_by_severity`** function in [`app/views.py`](https://github.com/mpast/mobileaudit/blob/main/app/views.py) aggregates scan results by severity for dashboard reporting.
- Severity levels are referenced via constants such as `Severity.CR` and `Severity.HI` when querying or creating `Finding` records.
- Database migrations enforce these five values at the schema level, ensuring consistent classification across the platform.

## Frequently Asked Questions

### What are the five severity levels in MobileAudit?

MobileAudit uses Critical, High, Medium, Low, and None. These are defined in the `Severity` enumeration in [`app/models.py`](https://github.com/mpast/mobileaudit/blob/main/app/models.py) with internal codes CR, HI, ME, LO, and NO respectively.

### How does MobileAudit store severity levels in the database?

Severity levels are stored as two-character codes (CR, HI, ME, LO, NO) in the database. The `Severity` `TextChoices` class maps these internal values to human-readable labels like "Critical" and "High" for display purposes.

### Can the severity levels be customized or extended?

No, the severity levels are hardcoded in the `Severity` enumeration and enforced by database constraints in the migration files. To add new levels, you would need to modify [`app/models.py`](https://github.com/mpast/mobileaudit/blob/main/app/models.py) to add new choices and create a new database migration.

### How do I filter findings by severity in MobileAudit?

Import the `Severity` enumeration from `app.models` and use Django's ORM filter method. For example: `Finding.objects.filter(scan=scan_id, severity=Severity.HI)` returns all high-severity findings for a specific scan.