Findings come from two sources. Violations of the IATI standard are taken
from the official IATI Validator and keep
its severity (critical/error/warning). Everything iati-scout adds on top
is reported as advisory, because a heuristic is not a standard violation —
filter on source, not severity, to separate them.