Bug Bounty Report Formatter

Format validated findings as platform-ready bug bounty reports that survive triage. Optimized for acceptance rate, not word count. The standard this targets: 7.00 HackerOne signal, precision over volume.

Title Convention

Format: [Component]: [Vulnerability Class] via [Mechanism]

Good titles (from real accepted advisories):

• zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write
• Parse Server: cloud function validator bypass via prototype chain traversal
• Directus: TUS Upload Authorization Bypass Allows Arbitrary File Overwrite
• lodash: Code Injection via _.template imports key names
• AVideo: Unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy
• OpenFGA: Unauthenticated playground endpoint discloses preshared API key

Rules:

• Component name first (the project/package name)
• Vulnerability class in plain English (not CWE numbers in the title)
• Mechanism must be specific (not "via user input", say "via prototype chain traversal")
• No adjectives like "critical" or "severe" in the title
• Under 120 characters

Report Template

The workflow selects the canonical record, requested destination schema and disclosure action. This optional presentation example does not create a second finding file or authorize submission. Destination-specific limits below are examples; the selected program's current requirements take precedence.

# {Title}

## Summary

{One paragraph. State what the bug is, where it lives (file:line or endpoint),
and what impact it has. Three sentences maximum.}

## Severity

**CVSS 3.1**: {full vector string} ({score} {severity_label})