0Pricing
Ethical Hacking Academy · Lesson

Writing Great Reports

Get paid.

Writing Great Reports is a free Ethical Hacking Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ethical Hacking Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

The Report Is the Product

Finding a bug is only half the job. The report is what you actually deliver, and what determines your bounty. A great bug with a poor report gets downgraded or rejected.

  • Triagers read dozens of reports daily
  • A clear, reproducible report saves them time and earns goodwill
  • Better reports get higher severity ratings and faster payouts

Treat report writing as a core skill, not an afterthought.

Anatomy of a Great Report

A strong report has a predictable structure the triager can scan quickly:

  • Title — vuln type + affected asset + impact
  • Summary — one or two sentences
  • Steps to reproduce — numbered, exact
  • Impact — what an attacker gains
  • Proof of concept — requests, screenshots, video
  • Remediation — how to fix it

Writing a Clear Title

The title is the first impression. Make it specific and impact-driven, not vague.

A good title encodes the bug type, the location, and the consequence.

# Weak
XSS found

# Strong
Stored XSS in profile 'bio' field on app.example.com leads to account takeover

# Strong
IDOR in GET /api/invoices/{id} exposes other users' invoices

Reproducible Steps

The most important section is steps to reproduce. The triager must be able to follow them exactly and see the bug. Be precise.

Number every step, include exact URLs, payloads, and expected vs actual results.

Steps to Reproduce:
1. Log in as User A and note invoice ID 1001.
2. Log in as User B in a separate session.
3. As User B, send: GET /api/invoices/1001
   Authorization: Bearer <User B token>
4. Observe: User B receives User A's invoice data.
Expected: 403 Forbidden. Actual: 200 OK with A's data.

Demonstrating Impact

Severity, and therefore payout, is driven by impact. Spell out concretely what an attacker can achieve.

  • Whose data is exposed and how much?
  • Can it lead to account takeover, RCE, financial loss?
  • Is authentication required? Any prerequisites?

Quantify it: 'any user can read all 200k invoices by iterating IDs' is far stronger than 'data leak'.

Strong Proof of Concept

A PoC removes all doubt. Include the raw requests/responses and visual proof.

  • Full HTTP request and response (redact your own secrets)
  • Screenshots showing the result
  • A short video for complex multi-step bugs

For automatable bugs, a minimal script makes reproduction trivial for the triager.

# Minimal PoC script for an IDOR
for id in $(seq 1000 1010); do
  curl -s -H 'Authorization: Bearer <token>' \
    https://app.example.com/api/invoices/$id
done
# Returns invoices belonging to other users.

Rating Severity with CVSS

Many programs use CVSS to assign severity. Understanding the vector helps you justify your rating and avoid disputes.

  • Attack Vector, Complexity, Privileges Required, User Interaction
  • Confidentiality, Integrity, Availability impact

Propose a CVSS score with reasoning, but let evidence, not inflated numbers, speak.

# Example CVSS 3.1 vector for an unauthenticated IDOR data leak
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
# Base score ~7.5 (High)

Suggesting Remediation

Including a fix recommendation shows professionalism and helps the team act fast. Map the fix to the root cause.

  • IDOR: enforce object-level authorization (check ownership server-side)
  • XSS: context-aware output encoding and a strict CSP
  • SSRF: allowlist outbound hosts, block link-local/private IPs

Concrete remediation builds trust and reputation.

Avoiding Duplicates and Noise

Two things tank your signal: duplicates and false positives.

  • Search the program's known issues and your own past reports first
  • Confirm the bug works reliably before submitting
  • Do not report informational findings the policy excludes

One well-evidenced valid report beats ten speculative ones.

Communicating With Triagers

After submission, professional communication matters.

  • Respond promptly to requests for clarification
  • Stay polite even if you disagree on severity, argue with evidence
  • Do not spam or demand faster handling

A good relationship with a program's team leads to private invites and bonus rewards.

Disclosure Ethics

Disclosure must follow the program's rules and the law.

  • Do not publish details until the program authorizes disclosure
  • Never threaten to release a bug to pressure for payment, that is extortion
  • Redact real user data from your PoC and screenshots

Responsible disclosure protects users and keeps you within safe harbor.

Quick Check

Which report element most directly influences the severity rating and therefore the size of the bounty?

Recap: Writing Great Reports

You learned to turn findings into reports that get paid.

  • Use a clear structure: title, summary, reproducible steps, impact, PoC, remediation
  • Write impact-driven titles and quantify the consequences
  • Provide a strong, raw proof of concept
  • Justify severity (e.g. CVSS) with evidence, not inflation
  • Protect your signal, communicate professionally, and disclose ethically

That completes Bug Bounty Hunting. You now know how to choose targets, scale recon, find core bugs, and report them well.

Frequently asked questions

Is the “Writing Great Reports” lesson free?

Yes — the full text of “Writing Great Reports” is free to read here on the web, and the Ethical Hacking Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ethical Hacking Academy course, upgrade to CoddyKit PRO.

What will I learn in “Writing Great Reports”?

Get paid. You practise Ethical Hacking Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Ethical Hacking Academy?

No prior experience is required. Ethical Hacking Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Writing Great Reports” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Ethical Hacking Academy lesson?

Yes. Every Ethical Hacking Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Choosing Targets
  2. Recon at Scale
  3. Finding Common Bugs
  4. Writing Great Reports
← Back to Ethical Hacking Academy