What is the difference between bug severity and priority?

Direct answer

What a strong answer covers

How it works

Severity describes the damage the defect does: data loss and security breaches are critical, a crash on a main flow is high, a wrong label is low. It is a property of the bug and is set by whoever can judge the technical and user impact. Priority describes when it will be fixed relative to everything else, and it is a business decision that weighs severity against who is affected, how many, whether a release or a contract depends on it, and what the workaround costs. Keeping the two separate prevents both inflation, where everything is marked critical to get attention, and neglect, where a low-severity issue on the signup page is left for months while it quietly costs customers.

Example

A crash when importing a rare file format is high severity but low priority because two users hit it a year and the workaround is easy. A misaligned button on the checkout page is low severity but became top priority the week before a marketing campaign because it made the page look untrustworthy. The triage meeting recorded both fields with the reasoning so the decisions could be revisited.

Common mistakes

• Using one field for both and arguing about what critical means.
• Letting reporters set priority based on how much the bug annoys them.
• Never revisiting priority when the release context changes.

A useful answer structure

Answer from your own work.

Do not memorise a script: use only examples you can explain honestly in follow-up questions.