====== Writing Good Reports ======

A good report is what separates a bounty from a duplicate or a N/A. Good reports build reputation and get private invites.

===== Report Structure =====

**Title:** [Bug Type] on [Feature/Endpoint] leads to [Impact]

Examples:
  * "Stored XSS in profile bio via unsanitized <script> tag leads to account takeover"
  * "CSRF on email change endpoint allows attacker to take over any account"
  * "Open Redirect at /oauth/callback chains with OAuth to steal access tokens"

===== Required Sections =====

  - **Title** -- descriptive, specific, includes impact
  - **Severity** -- Critical / High / Medium / Low with justification
  - **Summary** -- 2-3 sentences: what is the bug, where is it, what can an attacker do
  - **Steps to Reproduce** -- numbered, exact, reproducible from scratch
  - **Proof of Concept** -- working PoC code, screenshots, or video
  - **Impact** -- concrete damage an attacker can cause
  - **Remediation** -- suggested fix

===== Steps to Reproduce =====

Be so precise that a developer who has never seen this bug can reproduce it on the first try:

  - Numbered steps
  - Exact URLs
  - Exact payloads
  - Expected vs actual result
  - What account types/permissions are needed

===== Proof of Concept =====

PoC or GTFO. Show impact with:
  * Working exploit code (JavaScript, HTML, curl commands)
  * Screenshot of data exfiltrated or action performed
  * Video walkthrough for complex chains
  * Clear before/after showing the exploit succeeded

===== Common Reasons Reports Get Rejected =====

  * No PoC -- "this could theoretically..."
  * Impact too vague -- "attacker could use this for phishing"
  * Steps not reproducible -- missing account setup, missing exact URL
  * Out of scope target
  * Already known / duplicate
  * Requires unlikely user interaction

===== Building Relationships =====

  * Respond promptly to triager questions
  * Be helpful, not adversarial, when they push back
  * If they disagree on severity, explain your reasoning with evidence
  * Treat it as a collaboration -- they want to fix bugs too
  * Good reputation = private program invites = less competition

===== See Also =====

  * [[zseano:escalation|Bug Chaining & Escalation]]
  * [[zseano:program_selection|Picking a Program]]
  * [[zseano:start|Methodology Index]]