hunt-report-writing

# Report Writing ## Title Formula `[Vulnerability] in [Component] Enables [Impact]` Under 15 words. Title Case. Impact-forward. No URLs. | Bad | Good | |---|---| | XSS in search | Stored XSS in Comment Renderer Executes JavaScript in Admin Context | | IDOR found | IDOR in User API Exposes PII of All Platform Users | | SQL injection | Blind SQL Injection in Search Filter Enables Full Database Extraction | ## Structure 1. **Summary** (2-3 sentences): What's broken, what attacker can do, who's affected. 2. **Steps to Reproduce**: Numbered. ONE action per step. Exact URL, method, headers, body. 3. **Impact**: What attacker walks away with. How many users. Business impact. 4. **PoC**: Self-contained file. Screenshots at each step. Video if multi-step. 5. **CVSS 4.0**: Full vector string with justification per metric. 6. **Remediation**: 1-2 sentences. Developer-actionable. Specific fix. ## Style Rules - Human tone, technical but triager-accessible - Lead with impact, not process - No padding ("I discovered...", "During my testing...") - Every sentence adds information - Never submit without PoC + evidence ## Common Mistakes - Theoretical bugs ("could allow...") - Screenshots of Burp instead of clear steps - CVSS overclaiming - Same bug class on multiple endpoints as one report (should be separate) - Missing evidence attachment