How to Write a Bug Bounty Report That Gets Paid
Finding the bug is half the job. The other half is explaining it so a busy triager can reproduce it in minutes, believe the impact, and route it to the right engineer. Weak reports kill strong findings.
This guide is for authorized testing only. Use your own accounts and stay inside scope.
What triage actually needs
Every accepted report answers five questions fast:
- What is broken?
- Where exactly (asset, endpoint, parameter)?
- How do I reproduce it with your steps alone?
- What can an attacker achieve?
- How should it be fixed?
If any answer is vague, expect “Needs more information” or a silent downgrade.
A report structure that works
Title: vulnerability type + asset + impact in one line.
Bad: “XSS found.”
Good: “Stored XSS in support ticket subject → session theft in staff panel.”
Summary: two or three sentences. State the trust boundary that failed.
Steps to reproduce: numbered, minimal, copy-pasteable. Include method, URL, headers that matter, and the exact payload. Strip noise.
Evidence: screenshots or a short video of your account. Redact secrets. Prefer HTTP request/response pairs over walls of Burp history.
Impact: business language — account takeover, data exposure, privilege escalation, financial loss — tied to what you proved, not what you imagine.
Remediation: one concrete fix (output encoding, authorization check, allowlist). Triagers love actionable suggestions.
Common mistakes that lose bounty
- Skipping a login or setup step the triager does not know
- Reporting a client-only bug the server rejects
- Inflating severity without a working chain
- Dumping other users’ data to “prove” IDOR
- Duplicate wording without checking the program’s known issues
Severity without drama
Match the program’s CVSS / VRT guidance. A reflected XSS on a logged-out marketing page is not the same as stored XSS in an admin queue. Honest severity builds trust for your next report.
Defensive checklist (for teams)
- Publish a report template and severity rubric.
- Require two-account proofs for access-control bugs.
- Give hunters a staging tenant when production risk is high.
- Close the loop with root cause in the resolution note.
Clear writing is a hunting skill. Practice it on every lab finding before you hit production programs.
Original Bugflare guide informed by HackerOne report template guidance.