Report Psychology

Report Structure

# [Vuln Type] in [Feature] leads to [Impact]

## Summary
{What you accomplished in 2-3 sentences. Lead with result, not discovery method.}

## Expected vs Actual Behavior
**Expected:** {What should happen - specific security control}
**Actual:** {What actually happens - lead with the exploitation result}

## Steps to Reproduce

### Prerequisites
- Account A (victim): {email}, ID: {id}
- Account B (attacker): {email}, ID: {id}

### Steps
1. {exact URL or curl command}
2. {next action}
3. Observe: {what confirms the vuln}

## Impact
This vulnerability allows an attacker to {specific capability}.
**Affected users:** {scope/count}
**Business consequences:** {regulatory, financial, reputational}

## Supporting Material
{Screenshots, videos, HTTP logs - attached as files}

## Severity Justification
**CVSS 3.1:** {vector string} = {score} ({rating})
Per {program}'s policy: "{quoted section}"

## Recommended Fix
{Actionable remediation - where to add the check, what to validate}

Decision Trees

Ambiguous Response Handling

If any response looks like failure (success: false, error codes, empty arrays):

1. Flag it immediately at the step where it appears: "KEY FINDING"
2. Explain why it confirms the vuln (not denies it)
3. Show what an actual auth failure would look like for comparison
4. Verify the real impact in the next step

Gate: Every ambiguous response explained inline? Proceed.

Evidence Selection

Gate: Evidence meets minimum for complexity level? Proceed.

Impact Framing

Use business language, not technical:

Gate: Impact uses business language with scope quantified? Proceed.

Severity Justification

1. Calculate CVSS 3.1 vector (metric by metric, no rounding)
2. Quote program's severity policy section that supports your rating
3. Cite 1+ comparable public H1 reports at the same severity

Gate: CVSS + policy quote + comparable report? Proceed.

Timing

Best days: Tuesday-Thursday. Avoid Friday afternoon and weekends.

Gate: Severity-appropriate timing? Submit.

Post-Submit Quality Check

After writing, verify against these failure modes (from real experience):

Gate: No failure modes present? Report is ready.