Vulnerability Report Writing
Write clear, reproducible, high-impact vulnerability reports that maximise the chance of acceptance and appropriate bounty payout.
Tools
Machine-readable JSON available at:
https://reconatlas.pages.dev/api/checklists/vulnerability-reportingTags
// checklist steps
report-01
Write a clear descriptive title
Craft a title that includes the vulnerability type, affected component, and impact in a single line.
Avoid vague titles like "XSS found" or "Security issue". Include the endpoint and the specific impact. Triage teams prioritise reports with clear titles.
report-02
Assess severity using CVSS scoring
Calculate the CVSS 3.1 base score using the official calculator, considering attack vector, complexity, privileges required, and impact dimensions.
Do not inflate your CVSS score — experienced triagers will recalculate it. A well-justified medium is better received than an unjustified critical.
report-03
Write step-by-step reproduction instructions
Document exact reproduction steps that a triager can follow without any guesswork, including URLs, parameters, headers, and expected responses at each step.
curl -sk -X POST https://target.com/api/vulnerable-endpoint -H 'Content-Type: application/json' -d '{"payload":"value"}'Number each step. Include what the triager should observe at each step. Assume the reader has no context about your testing process.
report-04
Document impact assessment
Describe the concrete impact — what data is at risk, how many users are affected, what actions an attacker could perform, and the business consequences.
Frame impact in business terms. Quantify whenever possible — number of affected users, type of data exposed, potential financial loss.
report-05
Provide remediation recommendations
Suggest specific technical fixes for the vulnerability, referencing OWASP guidelines or framework-specific best practices.
Keep recommendations actionable. Reference the specific OWASP cheat sheet where applicable.
report-06
Attach screenshot and video evidence
Capture screenshots of each key step, annotate them with numbered callouts, and record a video walkthrough for complex chains.
Annotate screenshots with arrows and numbered callouts matching your reproduction steps. For video, narrate what you are doing and keep it under 3 minutes.
report-07
Include raw HTTP request and response evidence
Attach the raw HTTP requests and responses from Burp Suite or browser DevTools that demonstrate the vulnerability.
curl -sk -v -X POST https://target.com/api/vulnerable-endpoint -d 'payload=test' 2>&1 | tee evidence.txtInclude the full request with headers, the full response with headers, and highlight the specific part that demonstrates the vulnerability.
Overview
A well-written vulnerability report is the difference between a quick triage, generous bounty, and reputation boost versus a months-long back-and-forth that ends in frustration. Invest as much effort in the report as you did in finding the vulnerability.
Report structure
- Title — vulnerability type + affected component + impact
- Severity — CVSS score with vector string and justification
- Description — what the vulnerability is and why it matters
- Reproduction steps — numbered, exact, copy-paste ready
- Impact — what an attacker can do, quantified where possible
- Evidence — screenshots, video, HTTP request/response
- Remediation — specific, actionable technical recommendations
Common mistakes
- Submitting reports without testing on the latest version of the application
- Using automated scanner output as the report body
- Inflating severity without justification
- Missing reproduction steps that a triager cannot follow
- Reporting theoretical vulnerabilities without proof of exploitation