{
  "slug": "vulnerability-reporting",
  "title": "Vulnerability Report Writing",
  "phase": "Reporting",
  "description": "Write clear, reproducible, high-impact vulnerability reports that maximise the chance of acceptance and appropriate bounty payout.",
  "difficulty": "low",
  "tags": [
    "reporting",
    "documentation",
    "cvss",
    "impact-assessment",
    "reproduction-steps"
  ],
  "tools": [
    "CVSS calculator",
    "Markdown",
    "screen recording tools"
  ],
  "steps": [
    {
      "id": "report-01",
      "title": "Write a clear descriptive title",
      "description": "Craft a title that includes the vulnerability type, affected component, and impact in a single line (e.g., \"Stored XSS in /comments allows session hijacking via crafted payload\").",
      "notes": "Avoid vague titles like \"XSS found\" or \"Security issue.\" Include the endpoint and the specific impact. Triage teams prioritise reports with clear titles."
    },
    {
      "id": "report-02",
      "title": "Assess severity using CVSS scoring",
      "description": "Calculate the CVSS 3.1 base score using the official calculator, considering attack vector, complexity, privileges required, and impact dimensions.",
      "notes": "Do not inflate your CVSS score — experienced triagers will recalculate it. A well-justified medium is better received than an unjustified critical."
    },
    {
      "id": "report-03",
      "title": "Write step-by-step reproduction instructions",
      "description": "Document exact reproduction steps that a triager can follow without any guesswork, including URLs, parameters, headers, and expected responses at each step.",
      "commands": [
        "curl -sk -X POST https://target.com/api/vulnerable-endpoint -H 'Content-Type: application/json' -d '{\"payload\":\"value\"}'"
      ],
      "notes": "Number each step. Include what the triager should observe at each step (e.g., \"You should see a 200 response containing...\"). Assume the reader has no context about your testing process."
    },
    {
      "id": "report-04",
      "title": "Document impact assessment",
      "description": "Describe the concrete impact: what data is at risk, how many users are affected, what actions an attacker could perform, and the business consequences.",
      "notes": "Frame impact in business terms: \"An attacker can access any user's payment history including full card numbers\" is more compelling than \"IDOR allows unauthorized data access.\" Quantify whenever possible."
    },
    {
      "id": "report-05",
      "title": "Provide remediation recommendations",
      "description": "Suggest specific technical fixes for the vulnerability, referencing OWASP guidelines or framework-specific best practices.",
      "notes": "Keep recommendations actionable: \"Implement parameterised queries using PreparedStatement\" is better than \"Fix the SQL injection.\" Reference the specific OWASP cheat sheet where applicable."
    },
    {
      "id": "report-06",
      "title": "Attach screenshot and video evidence",
      "description": "Capture screenshots of each key step, annotate them with numbered callouts, and record a video walkthrough for complex chains.",
      "notes": "Annotate screenshots with arrows and numbered callouts matching your reproduction steps. For video, narrate what you are doing and keep it under 3 minutes. Include both the request and the response in your evidence."
    },
    {
      "id": "report-07",
      "title": "Include raw HTTP request/response evidence",
      "description": "Attach the raw HTTP requests and responses (from Burp Suite or browser DevTools) that demonstrate the vulnerability.",
      "commands": [
        "curl -sk -v -X POST https://target.com/api/vulnerable-endpoint -d 'payload=test' 2>&1 | tee evidence.txt"
      ],
      "notes": "Include the full request with headers, the full response with headers, and highlight the specific part that demonstrates the vulnerability. Redact any credentials that are not relevant to the finding."
    }
  ],
  "references": [
    "https://www.first.org/cvss/calculator/3.1",
    "https://cheatsheetseries.owasp.org/cheatsheets/Vulnerability_Disclosure_Cheat_Sheet.html",
    "https://portswigger.net/web-security",
    "https://owasp.org/www-project-web-security-testing-guide/",
    "https://docs.hackerone.com/hackers/quality-reports/"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-06-17"
}