Remove severity and quality scoring, classifier is extraction-only

README.md

@@ -31,8 +31,6 @@ Create `.env`:
 
 ```env
 BOT_TOKEN=your_token_here
-MIN_QUALITY_SCORE=0
-ALLOWED_SEVERITIES=critical,high,medium,low
 ```
 
 Run:
@@ -95,21 +93,9 @@ The enrichment lines (CVEs, actors, malware) only appear when the classifier fin
 
 **Threat actors** — APT groups and named adversaries: APT28/29/40/41, Lazarus, Sandworm, Volt Typhoon, Scattered Spider, FIN7, and others defined in `THREAT_ACTORS`.
 
-**Malware families** — ransomware, C2 frameworks, loaders, stealers, and APT tooling: LockBit, Cobalt Strike, Emotet, QakBot, Sliver, PlugX, and others defined in `MALWARE_FAMILIES`. To add a family, append its display name to the set — matching is case-insensitive.
+**Malware families** — ransomware, C2 frameworks, loaders, stealers, and APT tooling: LockBit, Cobalt Strike, Emotet, QakBot, Sliver, PlugX, and others defined in `MALWARE_FAMILIES`. To add a family, append its display name to the set — matching is case-insensitive with word-boundary checking to avoid false positives.
 
-**Severity** is keyword-based:
-- `critical` — zero-days, active exploitation, RCE, ransomware
-- `high` — privesc, auth bypass, code execution, kernel exploits
-- `medium` — XSS, CSRF, DoS, memory corruption
-- `low` — everything else
-
-**Quality score (0–100)** factors in: source reputation, content length, CVE presence, PoC indicators, threat actor mentions.
-
-Filter via env vars:
-```env
-MIN_QUALITY_SCORE=50
-ALLOWED_SEVERITIES=critical,high
-```
+Severity and quality scoring were intentionally removed — the extracted enrichment fields (CVEs, actors, malware) give the reader enough context to judge importance themselves.
 
 ## Systemd Service (VPS)