Writing Great Reports
Get paid.
The Report Is the Product
Finding a bug is only half the job. The report is what you actually deliver, and what determines your bounty. A great bug with a poor report gets downgraded or rejected.
- Triagers read dozens of reports daily
- A clear, reproducible report saves them time and earns goodwill
- Better reports get higher severity ratings and faster payouts
Treat report writing as a core skill, not an afterthought.
Anatomy of a Great Report
A strong report has a predictable structure the triager can scan quickly:
- Title — vuln type + affected asset + impact
- Summary — one or two sentences
- Steps to reproduce — numbered, exact
- Impact — what an attacker gains
- Proof of concept — requests, screenshots, video
- Remediation — how to fix it
All lessons in this course
- Choosing Targets
- Recon at Scale
- Finding Common Bugs
- Writing Great Reports