This will hopefully make it easier for the future to categorize vulnerability reports in the future, and gives better guidance to our users.

Some doubts I have:

• CVSS doesn't work well for vulnerabilities affecting Babel's output, as most of its metrics depend on what environment is actually running the code generated by Babel. Maybe we should just not use CVSS there, and assign the severity manually based on how large impact we think a vulnerability can have?
• DoS attacks where you give Babel excessively complex input (e.g. hugely nested syntax, or a very large file) are not security vulnerabilities, but maybe "The attacker gave me this trivial input, I run it through Babel, and now the process is stuck" should be? Or are they just bugs? If you need to protect against "excessively complex input code" the only reasonable protection is to be able to kill Babel when it takes too long anyway.