← Return to Ledger

Writing Reports That Get Paid

Structural Anatomy of an Elite Report

Triagers process hundreds of items daily. Your formatting must be surgical, concise, and focused on demonstrating risk rather than explaining background theory.

1. Title Structure: Isolate the vulnerability class, endpoint, and core risk in a single phrase. Avoid generic labels like "IDOR vulnerability".
2. Reproduction Steps: Provide simple, numbered, line-by-line setups with clean state segregation (e.g., Account A vs. Account B).
3. Proof of Concept: Include raw HTTP request/response text streams from Burp History logs rather than non-replayable browser image uploads.

Drill Sandbox 14 — Signal-to-Noise Report Compiler

Draft vulnerability findings using the matrix structure below. The processing engine dynamically checks text weights for filler words, verification barriers, and clarity metrics.

Triage Lifecycle & Crisis Management

What happens *after* submission defines your corporate reputation footprint. Handing unexpected pushback cleanly avoids account restrictions and penalty status locks.

Triage Scenario	Tactical Execution Protocol
The Incorrect N/A Flag	Wait 24 hours to prevent emotional responses. Counter cleanly with one single HTTP stream proof validating the missing security control. Avoid aggressive or condescending language.
The Duplicate Return	Request the original disclosed report id string. If your exploitation chain utilizes a distinct vector or hits a completely isolated subsystem, document that delta immediately.
The Severity Downgrade	Argue once using pure data points or CVSS metric variables. If the triage team holds their boundary stance after your single push, accept the ruling and move to your next asset target.

Your Tasks for This Final Chapter