Finding reporting
Build a concise finding from durable evidence while separating validated behavior, modeled impact, and unresolved uncertainty.
This is the complete downloadable file. Open plain text ↗
---
name: reporting
description: "Build a concise finding from durable evidence while separating validated behavior, modeled impact, and unresolved uncertainty."
---
# Finding reporting
Build a concise finding from durable evidence while separating validated behavior, modeled impact, and unresolved uncertainty.
Defensive study and review of artifacts supplied by their owner. Record missing evidence as an open question.
## Bring to the review
- Validated check records and evidence references
- Relevant lead history
- Affected security boundary and remediation expectation
## Review guide
### 1. Assemble only supporting records
Use search_hunt_records to retrieve the exact assets, checks, leads, and evidence that support the report. Keep observations and validated findings in separate sentences.
### 2. State impact at its evidence level
Describe direct impact as observed, plausible impact as modeled, and remaining gaps as uncertainty. A lead does not become a vulnerability merely because it is ranked highly.
### 3. Export a reviewable brief
When a local Hunt Workbench is available, use export_handoff to generate a concise Markdown brief with scope, coverage, blockers, and evidence-linked next steps. Add public citations from hosted research only when they add context.
## MCP calls
Public research on the hosted MCP (generic topics only): `get_research_context`, `search_research`, `get_research_record`.
Durable records in the selected local workspace: `search_hunt_records`, `record_check`, `upsert_lead`, `export_handoff`.
Keep private evidence and scope records in the local workspace.
## What to produce
- Evidence-bounded finding draft
- Explicit impact and uncertainty statement
- Portable Markdown brief with record references
## Common mistakes
- Claiming impact beyond the records
- Embedding secrets or unneeded third-party data
- Presenting a lead as validated
## Reading and source context
### Resources
- [Quality Reports](https://vulns.co/research/resources/hackerone-quality-vulnerability-reports/)
- [OWASP Logging: trustworthy and minimal application evidence](https://vulns.co/research/resources/owasp-security-logging-evidence-quality/)
### Diagrams
- [Approval stays attached to the reviewed version](https://vulns.co/research/diagrams/approval-version-integrity/)
### Reports
- [Cloud Build approval was not bound to immutable code](https://vulns.co/research/reports/google-cloud-build-approval-toctou-2025/)
- [GitHub Actions trust depended on invalid repository references](https://vulns.co/research/reports/github-actions-reference-validation-2021/)
## Provenance
Editorial guide by vulns.co / GK Data. Updated 2026-10-12.
Library snapshot: 2026-10-04; commit d5550c7891119cf1379e235721541c947850a3b3.
The guide is an editorial synthesis. Linked records preserve their own sources and review dates.
Reader: https://vulns.co/skills/reporting/
The review
What to look for
Defensive study and review of artifacts supplied by their owner. Record missing evidence as an open question.
Assemble only supporting records
Use search_hunt_records to retrieve the exact assets, checks, leads, and evidence that support the report. Keep observations and validated findings in separate sentences.
State impact at its evidence level
Describe direct impact as observed, plausible impact as modeled, and remaining gaps as uncertainty. A lead does not become a vulnerability merely because it is ranked highly.
Export a reviewable brief
When a local Hunt Workbench is available, use export_handoff to generate a concise Markdown brief with scope, coverage, blockers, and evidence-linked next steps. Add public citations from hosted research only when they add context.
What to produce
- Evidence-bounded finding draft
- Explicit impact and uncertainty statement
- Portable Markdown brief with record references
Common mistakes
- Claiming impact beyond the records
- Embedding secrets or unneeded third-party data
- Presenting a lead as validated
Use with MCP
Take this into the workbench.
The hosted MCP reads public research. The separate local Hunt Workbench saves private project records in your chosen directory.
Public context
get_research_context search_research get_research_record
Local record tools
search_hunt_records record_check upsert_lead export_handoff
Continue the study
Reading & source context
Editorial notes above connect these references. Open each record for its original source and review date.
Visual models
Connected disclosures
From the field toolkit
Guide by GK Data · Research snapshot 2026-10-04.
Sources and review dates are preserved in the library provenance.