REPORT WRITING

Impact-first. Human tone. No theoretical language. Triagers are people.

THE MOST IMPORTANT RULE

Distinguish demonstrated behavior from untested hypotheses and state uncertainty precisely. Do not present untested impact as observed. A bounded, labeled hypothesis or suspected vulnerability can still be reported when the program permits it; do not exceed scope to manufacture proof.

BAD:  "This vulnerability could potentially allow an attacker to access user data."
GOOD: "An attacker can access any user's order history by changing the user_id
       parameter to the target user's ID. I confirmed this using two test accounts:
       attacker@test.com (ID 123) successfully retrieved victim@test.com (ID 456)
       orders, including their shipping address and payment method last 4 digits."