---
name: reporting
description: "Build a concise finding from durable evidence while separating validated behavior, modeled impact, and unresolved uncertainty."
---

# Finding reporting

Build a concise finding from durable evidence while separating validated behavior, modeled impact, and unresolved uncertainty.

Defensive study and review of artifacts supplied by their owner. Record missing evidence as an open question.

## Bring to the review

- Validated check records and evidence references
- Relevant lead history
- Affected security boundary and remediation expectation

## Review guide

### 1. Assemble only supporting records

Use search_hunt_records to retrieve the exact assets, checks, leads, and evidence that support the report. Keep observations and validated findings in separate sentences.

### 2. State impact at its evidence level

Describe direct impact as observed, plausible impact as modeled, and remaining gaps as uncertainty. A lead does not become a vulnerability merely because it is ranked highly.

### 3. Export a reviewable brief

When a local Hunt Workbench is available, use export_handoff to generate a concise Markdown brief with scope, coverage, blockers, and evidence-linked next steps. Add public citations from hosted research only when they add context.

## MCP calls

Public research on the hosted MCP (generic topics only): `get_research_context`, `search_research`, `get_research_record`.

Durable records in the selected local workspace: `search_hunt_records`, `record_check`, `upsert_lead`, `export_handoff`.

Keep private evidence and scope records in the local workspace.

## What to produce

- Evidence-bounded finding draft
- Explicit impact and uncertainty statement
- Portable Markdown brief with record references

## Common mistakes

- Claiming impact beyond the records
- Embedding secrets or unneeded third-party data
- Presenting a lead as validated

## Reading and source context

### Resources

- [Quality Reports](https://vulns.co/research/resources/hackerone-quality-vulnerability-reports/)
- [OWASP Logging: trustworthy and minimal application evidence](https://vulns.co/research/resources/owasp-security-logging-evidence-quality/)

### Diagrams

- [Approval stays attached to the reviewed version](https://vulns.co/research/diagrams/approval-version-integrity/)

### Reports

- [Cloud Build approval was not bound to immutable code](https://vulns.co/research/reports/google-cloud-build-approval-toctou-2025/)
- [GitHub Actions trust depended on invalid repository references](https://vulns.co/research/reports/github-actions-reference-validation-2021/)

## Provenance

Editorial guide by vulns.co / GK Data. Updated 2026-10-12.
Library snapshot: 2026-10-04; commit d5550c7891119cf1379e235721541c947850a3b3.
The guide is an editorial synthesis. Linked records preserve their own sources and review dates.

Reader: https://vulns.co/skills/reporting/