writing-pentest-finding

To write a penetration test finding, provide precise affected-asset details, replayable reproduction steps, and sanitized evidence references so the customer engineer can verify the vulnerability without back-and-forth.

Calculating CVSS v3.1 vectors requires a defensible breakdown of the vulnerability's characteristics, transforming technical evidence into a polished report entry that validates whether the severity band is Low, Medium, High, or Critical.

Writing remediation guidance involves recommending specific, code-level fixes and explaining why superficial mitigations are insufficient, ensuring the client receives actionable steps to resolve the confirmed vulnerability.

You can document chained findings by validating whether multiple low-severity issues combine into a higher-impact path, allowing the creation of separate chain findings across web, API, and admin-user attack paths.

Drafting a bug bounty submission requires turning technical evidence into a client-deliverable finding that includes concrete business impact, a defensible CVSS v3.1 vector, and sanitized evidence references.

You need to write a separate chain finding when multiple low-severity vulnerabilities combine into a higher-impact path, ensuring the final penetration test report accurately reflects the escalated severity and business impact.