Vulnerability Report Writing

Write one report per vulnerability using a structured template covering summary, severity with CVSS score, affected component, root cause, proof of concept steps, impact assessment, and suggested remediation. Include file paths and line numbers so maintainers can verify and fix the issue.

Assign severity using evidence-based checklists: Critical requires unauthenticated exploitation with full CIA impact, High requires clear exploit paths affecting sensitive data, and lower ratings apply to conditional or limited-impact issues. Use the CVSS 3.1 vector components (AV, AC, PR, UI, S, C/I/A) to compute the score.

A proof of concept should include prerequisites, detailed numbered reproduction steps with exact values, and a code-level trace showing the path from user input through the entry point to the dangerous sink. Someone else must be able to verify the finding from your steps alone.

Do not submit when the vulnerability is theoretical without a reproducible proof of concept, when exploitation cannot be demonstrated in a sandbox, or when the target is out of scope for the bounty program. Speculative or inflated reports damage researcher credibility.

Reports get rejected when claimed severity exceeds demonstrable impact, such as rating a finding Critical without showing unauthenticated exploitation or production data impact. Calibrate by checking mitigating controls and confirming the exploit works in a fresh environment.