The same kind of problem, an unparameterized SQL string built from request input, is labelled "critical" on one PR and "minor" on another, so the team can't use severity to decide what blocks a merge. The prompt currently says "assign an appropriate severity: critical, major, or minor." What is the most effective fix?

Answer: B — Define explicit criteria for each severity level, each with concrete code examples showing what belongs at that level and why it qualifies.

Section 6 says consistent severity classification comes from explicit severity criteria with concrete code examples for each level. (a) adds a self-reported confidence number, which does nothing to make the labels consistent. (c) is a vague instruction that leaves the levels undefined. (d) removes the feature the team needs instead of fixing it.