bounty-report-formatter

Bug Bounty Report Formatter

Format validated findings as platform-ready bug bounty reports that survive triage. Optimized for acceptance rate, not word count. The standard this targets: 7.00 HackerOne signal — precision over volume.

Title Convention

Format: [Component]: [Vulnerability Class] via [Mechanism]

Good titles (from real accepted advisories):

• zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write
• Parse Server: cloud function validator bypass via prototype chain traversal
• Directus: TUS Upload Authorization Bypass Allows Arbitrary File Overwrite
• lodash: Code Injection via _.template imports key names
• AVideo: Unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy
• OpenFGA: Unauthenticated playground endpoint discloses preshared API key

Rules:

• Component name first (the project/package name)
• Vulnerability class in plain English (not CWE numbers in the title)
• Mechanism must be specific (not "via user input" — say "via prototype chain traversal")
• No adjectives like "critical" or "severe" in the title
• Under 120 characters

Report Template

Write to workspace/findings/BOUNTY-{finding_id}.md:

# {Title}

## Summary

{One paragraph. State what the bug is, where it lives (file:line or endpoint),
and what impact it has. Three sentences maximum.}

## Severity

**CVSS 3.1**: {full vector string} ({score} {severity_label})

| Metric | Value | Justification |
|--------|-------|---------------|
| AV | Network | Exploitable over HTTP |
| AC | Low | No special conditions |
| PR | None | No authentication required |
| UI | None | No user interaction |
| S | Unchanged | Impact limited to vulnerable component |
| C | High | Full read access to filesystem |
| I | None | No write capability demonstrated |
| A | None | No availability impact |

## Affected Version

- Package: {name}
- Version: {exact version or range}
- Commit: {commit hash if applicable}

## Steps to Reproduce

1. {Exact setup step — e.g., "Clone the repository: `git clone ...`"}
2. {Exact action — e.g., "Start the server: `npm start`"}
3. {Exact exploit — e.g., "Send the following request:"}

## Proof of Concept

\```bash
{Exact command that demonstrates the vulnerability}
\```

**Expected response (vulnerable):**
\```
{Exact output showing exploitation}
\```

**Baseline response (not vulnerable):**
\```
{Output from the same request without the payload}
\```

## Impact

{What an attacker can actually do with this bug. Only state impacts you
demonstrated in the PoC. Do NOT extrapolate to theoretical scenarios.}

## Remediation

{Specific code fix. Show the diff or the corrected code.}

\```diff
- const user = db.query(`SELECT * FROM users WHERE id=${req.params.id}`)
+ const user = db.query(`SELECT * FROM users WHERE id=$1`, [req.params.id])
\```