Bug Bounty Report Writing

Turn findings into reports that triagers accept quickly and rate fairly.

Report Structure

1. Title — vulnerability class + affected asset. Stored XSS in ticket comment field on support.example.com
2. Severity & CVSS — your suggested rating with vector string
3. Summary — 2–3 sentences: what, where, impact
4. Steps to Reproduce — numbered, copy-pasteable, no assumptions
5. Impact — what an attacker gains, concretely
6. Supporting Material — HTTP requests/responses, screenshots with sensitive data redacted
7. Remediation — specific fix recommendation

Rules