How to Write a Good Vulnerability Report
A brilliant finding is worthless if the report is unclear. Whether you are doing bug bounties or professional penetration testing, the report — not the exploit — is the actual deliverable, because a vulnerability only creates value once someone fixes it. Writing reports well is a career skill as important as finding the bugs.
The structure of a good report#
A reader should be able to reproduce and fix the issue without ever contacting you:
| Section | Purpose |
|---|---|
| Title | Clear, specific summary of the issue |
| Summary & impact | What it is and why it matters |
| Affected component | Exactly where |
| Reproduction steps | Precise, numbered, complete |
| Evidence | Screenshots or a proof of concept |
| Severity | Assessed via CVSS and real impact |
| Remediation | How to fix it |
The two sections people skimp on — reproduction steps and remediation — are the ones the reader needs most. Precise steps let them confirm the issue; clear remediation lets them fix it fast.
Write for the person who has to fix it#
Frame the report around the reader’s job: confirming the bug is real, understanding its impact, and resolving it. Explain the impact in their terms (“an attacker could read any user’s records”), not just the technical mechanism. Clear, respectful reports earn higher bounty rewards, faster triage, and a professional reputation.
Report-writing turns findings into impact. More at the Careers & Practice hub.
Frequently asked questions#
What should a vulnerability report include?
A clear title, a summary of the issue and its impact, the affected component, precise reproduction steps, evidence (screenshots or a proof of concept), an assessment of severity and real-world impact, and remediation guidance. The reader should be able to reproduce the issue and understand how to fix it without contacting you.
Why does report quality matter so much?
Because a finding only creates value once someone fixes it, and a confusing report delays or prevents that. In bug bounties, clear reports earn higher rewards and faster triage; in professional work, they are the actual deliverable. The ability to communicate a vulnerability clearly is as important as finding it.