separated from #975 for better scope

• severities aren't covering all important cases. we need to go through the rules and think which should be HIGH and which shouldn't.