report

/report

Generate a professional disclosure report for a confirmed vulnerability finding.

Prerequisites

• Finding must be CONFIRMED by the Validator (verdict.md exists with CONFIRMED)
• PoC must be working (poc_*.py exits 0)
• CVSS score must be calculated

Process

Step 1: Gather Finding Details

Read from the target directory:

• targets/<repo>/findings.md for technical details
• targets/<repo>/verdict.md for confirmation
• targets/<repo>/poc_<vuln_type>.py for the PoC header
• targets/<repo>/brief.md for project info

Step 2: Determine Disclosure Channel

Check in priority order:

1. HackerOne: Search for the project

   curl -s "https://hackerone.com/directory/programs" | grep -i "<project>"
   

   If found -> use HackerOne format

2. GitHub Security Advisory: Check if repo has advisories enabled

   gh api "repos/<owner>/<repo>" --jq '.has_security_policy // false'
   

   If true -> use GHSA format

3. SECURITY.md: Check for security contact

   gh api "repos/<owner>/<repo>/contents/SECURITY.md" --jq '.content' | base64 -d 2>/dev/null
   

   If exists -> use email format

4. Package maintainer email: Check package registry

   npm view <package> maintainers --json 2>/dev/null
   

   If found -> use email format

5. GitHub Issue: Last resort

Step 3: Generate Report

GitHub Security Advisory Format

## Summary

[Vulnerability Type] in [package-name] [component] allows [impact description].

## Details

**Affected package**: [name]
**Affected versions**: [version range, e.g., "<= 3.2.1"]
**Patched version**: None (0-day)

### Root Cause

[Technical description of the vulnerability. Include the file path and line number.
Explain why the current code is vulnerable and what an attacker can do.]

### Attack Vector

[Step-by-step description of how an attacker would exploit this.]

1. [Step 1]
2. [Step 2]
3. [Step 3]

### Impact

[What an attacker can achieve. Be specific: read files, execute commands, etc.]

## Proof of Concept

[PoC code or steps to reproduce]

## Severity

**CVSS**: [vector string] = [score] [severity]
**CWE**: [CWE-XXX] ([name])

## Suggested Fix

[Specific recommendation for how to fix the vulnerability.
Include code examples if possible.]

## Timeline

- [Date]: Vulnerability discovered
- [Date]: Report submitted via [channel]
- [Date + 90 days]: Planned public disclosure (if no response)