/report-writing

Report Writing

Title Formula

`[Vulnerability] in [Component] Enables [Impact]`

Under 15 words. Title Case. Impact-forward. No URLs.

| Bad | Good | |---|---| | XSS in search | Stored XSS in Comment Renderer Executes JavaScript in Admin Context | | IDOR found | IDOR in User API Exposes PII of All Platform Users | | SQL injection | Blind SQL Injection in Search Filter Enables Full Database Extraction |

Structure

1. **Summary** (2-3 sentences): What's broken, what attacker can do, who's affected. 2. **Steps to Reproduce**: Numbered. ONE action per step. Exact URL, method, headers, body. 3. **Impact**: What attacker walks away with. How many users. Business impact. 4. **PoC**: Self-contained file. Screenshots at each step. Video if multi-step. 5. **CVSS 4.0**: Full vector string with justification per metric. 6. **Remediation**: 1-2 sentences. Developer-actionable. Specific fix.

Style Rules

• Human tone, technical but triager-accessible
• Lead with impact, not process
• No padding ("I discovered...", "During my testing...")
• Every sentence adds information
• Never submit without PoC + evidence

Common Mistakes

• Theoretical bugs ("could allow...")
• Screenshots of Burp instead of clear steps
• CVSS overclaiming
• Same bug class on multiple endpoints as one report (should be separate)
• Missing evidence attachment