Writing a Report That Survives Triage
A finding that cannot be reproduced from the text is not a finding. Write for a tired triager on their third coffee.
Tags: report, triage, vrt
Level: beginner
Method
One-sentence impact
Who the attacker is, who the victim is, what happens. If you cannot say it in one sentence, you do not understand it yet.
Steps that start from zero
Accounts, URLs, verbs, bodies, expected vs actual. No 'repeat step 4 with Burp'. Numbered, copy-pasteable.
Evidence
Request/response pairs, not essays. Redact secrets. Show the second user. Show the cache HIT. Show the canary.
VRT / CWE honestly
Do not file a P1 for an open redirect. Map the chain if you have one; map the gadget if you do not.
Skeptic pass
Run the Before you submit checklist. Kill confounders. State residual doubt.
Field notes
- Titles like 'IDOR on GET /api/invoices/{id} lets any user read any invoice PDF' get triaged. 'Broken access control' does not.
- If you used a chain, say which gadgets are already known so they do not duplicate-close the interesting half.