Custom nuclei templates

When it applies

You confirmed a bug (or a CVE pattern) and want to (a) find every other affected host and (b) keep a regression check. A nuclei template turns "one request + one match condition" into a scalable, shareable detector.

Why it works

nuclei runs declarative YAML: send request(s), assert matchers on the response. If your finding is expressible as request→observable signal, it's a template — and then it scans thousands of hosts consistently, no manual repetition.