Severity dispute on CVEs

I'm wondering where the folks here fall when it comes to [this discussion](https://www.bleepingcomputer.com/news/security/dev-rejects-cve-severity-makes-his-github-repo-read-only/).

When you find and report a bug, how deep do you go to find the level of severity and who do you report it to?

bug cybersecurity find go to report severity