# Bounty Report Formatter

Bug bounty report presentation, reproduction evidence and destination field conventions...

- Repository: https://github.com/BitterSecurity/Decepticon (6507 stars)
- Category: Documents
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BitterSecurity/Decepticon --skill bounty-report-formatter -g -a claude-code -y`
Codex: `npx skills add BitterSecurity/Decepticon --skill bounty-report-formatter -g -a codex -y`
Cursor: `npx skills add BitterSecurity/Decepticon --skill bounty-report-formatter -g -a cursor -y`
Gemini CLI: `npx skills add BitterSecurity/Decepticon --skill bounty-report-formatter -g -a gemini-cli -y`

## Description

Bug bounty report presentation, reproduction evidence and destination field conventions for HackerOne, Bugcrowd, Immunefi and GitHub Security Advisories.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Bug Bounty Report Formatter

Format validated findings as platform-ready bug bounty reports that
survive triage. Optimized for acceptance rate, not word count. The
standard this targets: 7.00 HackerOne signal, precision over volume.

## Title Convention

Format: `[Component]: [Vulnerability Class] via [Mechanism]`

Good titles (from real accepted advisories):
- `zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write`
- `Parse Server: cloud function validator bypass via prototype chain traversal`
- `Directus: TUS Upload Authorization Bypass Allows Arbitrary File Overwrite`
- `lodash: Code Injection via _.template imports key names`
- `AVideo: Unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy`
- `OpenFGA: Unauthenticated playground endpoint discloses preshared API key`

Rules:
- Component name first (the project/package name)
- Vulnerability class in plain English (not CWE numbers in the title)
- Mechanism must be specific (not "via user input", say "via prototype chain traversal")
- No adjectives like "critical" or "severe" in the title
- Under 120 characters

## Report Template

The workflow selects the canonical record, requested destination schema and
disclosure action. This optional presentation example does not create a second
finding file or authorize submission. Destination-specific limits below are
examples; the selected program's current requirements take precedence.

```markdown
# {Title}

## Summary

{One paragraph. State what the bug is, where it lives (file:line or endpoint),
and what impact it has. Three sentences maximum.}

## Severity

**CVSS 3.1**: {full vector string} ({score} {severity_label})

The rest: https://github.com/BitterSecurity/Decepticon/blob/HEAD/packages/decepticon/decepticon/skills/plugins/verifier/bounty-report/SKILL.md