What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
An actionable bug bounty report lets a reviewer start from a clean, authorized state, follow your numbered steps, observe the same behavior, and understand the security consequence without guessing. It names the exact target, prerequisites, requests or inputs, expected and actual results, and a proportionate proof of concept. It also stays inside the program’s scope, protects personal data, and separates demonstrated impact from speculation.
What “actionable” means in a bug bounty report
Actionability is the combination of reproducibility, understandable evidence, and a credible impact explanation. A triager who did not witness your discovery should be able to identify the affected asset, recreate the state you used, perform the same sequence, and verify the security result. The report should then make clear what an attacker can do, what access is required, and who or what could be affected.
As an Amazon Associate I earn from qualifying purchases.
HackerOne’s Code of Conduct summarizes the standard this way: “Reports must be accurate, reproducible, and demonstrate real-world impact.” Its Help Center similarly says, “A quality report provides clear, detailed, and actionable information about a vulnerability.” Bugcrowd’s researcher guidance says you generally need to explain where the bug was found, who it affects, how to reproduce it, which parameters it affects, and provide proof-of-concept information.
A vulnerability label by itself is not actionable. “IDOR,” “XSS,” or “authentication bypass” tells a reviewer what category you suspect, but not how to verify it or what the verified consequence is. A useful report connects the label to a specific route, input, account state, observable response, and impact.
#1 Best Overall
- Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities
- No Starch Press
- ABIS BOOK
Check authorization and scope before documenting the bug
Your report is only useful if the testing was permitted. Read the live program brief before testing and again before submitting. Scope, rate limits, account requirements, prohibited actions, disclosure terms, and evidence rules can differ between programs.
- Confirm the target: identify the exact in-scope domain, mobile application, API, repository, or feature. Do not assume that a related subdomain or third-party service is covered.
- Confirm the method: check whether automated requests, social engineering, denial-of-service testing, mass account creation, or access to real customer data is restricted.
- Use test data: create your own accounts and records where possible. Stop before an authorized test turns into access to another person’s private information.
- Record the rules that affect your finding: note required headers, account roles, test environments, rate limits, safe-harbor conditions, and any required submission fields.
HackerOne’s conduct guidance prohibits hazardous testing unless it is explicitly authorized. Its disclosure guidance also says reports should not include third-party personally identifiable information. Bugcrowd guidance likewise treats private-program vulnerability information as confidential unless the program permits disclosure. A program’s policy controls; there is no universal testing or publication rule.
Build a title and target line that remove ambiguity
Use an impact-oriented title
Write a concise title containing the vulnerability, affected feature or location, and meaningful demonstrated impact. A title such as “Unauthorized invoice download through account-ID substitution in Billing API” is more useful than “IDOR in API.” The first tells a triager what to test and why it matters without making an unsupported claim such as “full account takeover.”
Recommended Free Tools
Use the program’s preferred terminology when it is known, but do not force a classification that your proof does not support. If you are uncertain whether a behavior is an authorization flaw or an information disclosure, describe the observable behavior precisely and let the program classify it.
Identify the exact location
Give the in-scope asset and the narrowest useful location:
- Full URL, HTTP method, endpoint, parameter, fragment, or application screen.
- API version, request body field, header, cookie, or object identifier involved.
- Repository path, package version, mobile-app screen, or configuration name when relevant.
- Whether the behavior occurs in a production, staging, or other explicitly authorized environment.
Do not hide the location in a video. Put it in text so a reviewer can copy it, search for it, and compare it with the scope list.
Use a report structure a reviewer can execute
The following order matches the information a triager needs. Adapt field names to the program’s form; some programs add custom fields or request a severity selection.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRank #2
1. Summary
In one or two sentences, state what is wrong and the security consequence. Include the attacker’s starting access and the affected resource. For example: “A standard user can change the invoice_id value in the download request and retrieve another customer’s invoice. The server returns the file without checking that the invoice belongs to the requesting account.”
2. Preconditions
List only the setup that is necessary to reproduce the issue:
- Required account type or role.
- Whether two accounts, a victim record, or a prior action is needed.
- Required feature flags, subscription state, device, browser, or application version.
- Any timing, configuration, invitation, or victim-interaction dependency.
State what you used, such as “Account A is a standard user; Account B owns invoice 1842.” If a second account is needed, explain which account performs each action.
3. Steps to reproduce
Number every action in the order a reviewer should perform it. Each step should contain one unambiguous action and the value needed to perform it. Include requests and responses where they materially improve repeatability.
4. Expected and actual behavior
State the secure or documented result first, then the result you observed. This distinction is especially important for authorization, validation, and workflow flaws, where the application may appear to work normally until a boundary is crossed.
5. Proof of concept and evidence
Attach the smallest artifact that proves the behavior: a request-response excerpt, a short script, a screenshot, or a screen recording that supplements the written steps. Redact secrets, session tokens, API keys, and personal information.
6. Impact
Explain the realistic attacker capability, affected parties, and consequence. Tie each claim to what your proof demonstrates.
7. Optional remediation direction
A concise, technically sound suggestion can help, but HackerOne describes remediation suggestions as helpful rather than required. Do not prescribe a fix you cannot justify; explain the control that appears to be missing, such as server-side ownership validation.
How to write reproduction steps that work
Start from a clean state
Tell the reviewer how to reach the starting point. “Log in” is insufficient when the account must have a particular role, record, setting, or relationship. Say whether the account is newly created, whether a project was created first, and which user owns each object.
For a cross-account issue, define the actors explicitly:
- Account A: the attacker or lower-privileged user.
- Account B: the second user or victim account used to create the target object.
- Object: the record, file, message, or invitation whose identifier is tested.
Show the exact input and request
Include the URL, method, parameter names, and relevant values. For a web vulnerability, a compact request-response pair is often clearer than a long capture. Replace sensitive values with clearly defined placeholders inside code, and explain what each placeholder represents.
GET /api/invoices/1842/download HTTP/1.1
Host: example.test
Cookie: session=<Account-A-session>
HTTP/1.1 200 OK
Content-Type: application/pdf
Then explain the security-relevant change: “With Account A’s session unchanged, replacing 1842 with Account B’s invoice identifier returns the PDF.” Do not include a token that a reviewer could accidentally reuse against a real user.
Free tools Windows power users keep installed
One-click scans. No signup required.
Separate actions from observations
Write each step so the reviewer knows what to do and what to look for:
- Create Account B and generate an invoice. Note its identifier.
- Create Account A with the standard-user role.
- While authenticated as Account A, request the invoice-download endpoint for Account A’s own invoice and confirm that the normal download works.
- Change only the invoice identifier to Account B’s identifier and resend the request.
- Observe that the server returns Account B’s invoice instead of denying access.
This format establishes a control case, identifies the changed variable, and makes the unauthorized result observable. If a request must be sent twice, if a cache must be cleared, or if a link expires, state that dependency in the relevant step.
Describe timing and interaction dependencies
Some findings depend on a race window, an invitation, a password-reset email, or an action by another account. State the order, delay, number of attempts, and required interaction. If the issue is intermittent, report the observed conditions honestly rather than calling it deterministic. A reviewer can only reproduce a timing-dependent bug when the timing information is included.
Expected versus actual behavior: the shortest path to clarity
Use a two-part statement when the defect is not obvious from the steps:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- Expected: the server rejects a request when the authenticated user does not own the object, returns a generic error, and does not disclose the object’s contents.
- Actual: the server returns a successful response containing the other account’s file when only the object identifier is changed.
Avoid replacing this comparison with conclusions such as “broken access control.” The label can appear in the title or classification, but the expected and actual results are what let a triager confirm the defect.
Choose evidence that proves the specific claim
There is no universally best evidence format. Combine formats when one artifact cannot show the whole path, and judge each option by reproducibility, clarity, impact coverage, privacy risk, and program acceptance.
| Evidence | Best use | Strengths | Limits and precautions |
|---|---|---|---|
| Written numbered steps | Every finding | Searchable, durable, and easy to follow | Fails if prerequisites, values, or expected results are omitted |
| Request-response excerpt | API, authorization, validation, and protocol issues | Shows the exact input and server result | Redact cookies, tokens, identifiers, and personal data |
| Script or code snippet | Repeatable sequences or multi-step exploitation | Can reduce manual error and make a proof deterministic | Keep it minimal, explain dependencies, and ensure automated use is allowed |
| Screenshot | Visible UI result, exposed data, or configuration state | Quickly documents what appeared on screen | Cannot replace hidden setup or server-side evidence |
| Screen recording | Long UI flows, timing, or interaction between accounts | Shows a sequence that is difficult to describe visually | Must supplement written reproduction steps; redact data and avoid relying on video alone |
HackerOne’s conduct guidance says a report based solely on a video attachment may be closed as Not Applicable. Keep the written path and impact explanation even when a recording is useful. Bugcrowd also recommends illustrative evidence, but evidence should remain proportionate: an enormous traffic dump can obscure the one response that proves the issue.
Redact without destroying proof
Replace secrets and third-party data with labels such as <Account-A-session> and define them in the text. Preserve the fields needed to verify authorization, object ownership, status codes, error messages, and returned capability. If a screenshot contains unrelated customer information, crop it or reproduce the result with your own test data.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Explain impact without overstating severity
Impact should answer four questions:
- What access does the attacker need?
- What action can the attacker perform?
- What data, account, capability, or system is affected?
- How broad is the demonstrated reach?
For example, “A standard user can read invoices belonging to other customers when the identifier is known” is supportable if your proof retrieves those invoices. “This enables full account takeover” is not supportable unless the steps demonstrate a takeover path.
Describe mitigations and context. A finding may require an authenticated account, knowledge of an identifier, a victim click, or a specific configuration. Those conditions do not automatically eliminate impact, but omitting them makes the claim inaccurate. Distinguish observed access from a theoretical escalation that you did not test.
Bugcrowd’s Vulnerability Rating Taxonomy is a baseline; the rating ultimately applied can change when demonstrated impact is considered. HackerOne’s submission guidance references a CVSS calculator, while individual programs may use their own severity fields or rubrics. Select the program’s requested severity and explain the facts supporting it rather than treating a label as proof.
Current severity-form requirement on HackerOne
The HackerOne submission guide accessed for this article says that beginning September 21, 2026, severity selection is required for Bug Bounty, Vulnerability Disclosure, and Challenge programs that require severity, unless a program opts out. Form settings can differ, so check the live submission form and the specific program instructions immediately before submitting.
Privacy, safety, and disclosure obligations
Evidence collection can create a second problem if it exposes someone else’s information. Do not download unnecessary records, retain real credentials, or include personal data merely to make a report look convincing. Use the minimum data needed to demonstrate the behavior and tell the program if sensitive material was unavoidably encountered.
Stay within authorized testing boundaries. Stop when the next action would involve destructive changes, service disruption, persistence, credential theft, or access outside the stated scope. A private program’s report and vulnerability details may need to remain confidential. Publication is controlled by the program’s disclosure settings and policy, not by a universal waiting period.
A bounty is not guaranteed. HackerOne notes that some teams offer rewards, but not all; the security team decides eligibility and amount. Do not shape an impact claim around a hoped-for reward.
Why reports are marked “not reproducible”
“Not reproducible” often means the reviewer could not reach the demonstrated result from the supplied state, not that the underlying observation was impossible. Check these failure points before replying:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- Missing role: the reviewer used a normal user but your test required an administrator, organization member, or unverified account.
- Missing object setup: the record, invitation, feature flag, or relationship was never created.
- Wrong location: the report names a product but omits the route, method, parameter, application version, or region.
- Unclear variable: several request fields changed at once, so the reviewer cannot tell which input triggers the behavior.
- Expired state: a token, invitation, cache entry, or time window ended before testing.
- Evidence-only submission: the reviewer received a screenshot or video but no executable written path.
- Overstated impact: the visible behavior exists, but the claimed data access or privilege was not demonstrated.
Reply with a fresh, minimal reproduction using test accounts, identify any changed precondition, and attach a redacted request or response. Do not silently expand testing into a prohibited area just to make the result more dramatic.
Final pre-submission checklist
- Is the title specific about the vulnerability, target, location, and demonstrated consequence?
- Is the asset confirmed in scope, and did you follow its testing and disclosure rules?
- Can a reviewer create the same accounts, roles, records, and configuration from your preconditions?
- Are the steps numbered, ordered, and complete, with exact URLs, methods, parameters, inputs, and timing?
- Have you stated expected and actual behavior separately?
- Does at least one artifact prove the result, and do the written steps stand on their own?
- Are secrets, session values, third-party personal data, and unrelated records removed?
- Does the impact statement describe demonstrated attacker capability, affected parties, reach, and limitations?
- Is the severity consistent with the program’s rubric and the evidence, rather than a speculative worst case?
- Have you checked the live form for required severity, custom fields, attachment limits, and disclosure settings?
The practical test is simple: could a security reviewer who never saw your discovery reproduce the behavior and explain its consequence using only the report and safely shareable evidence? If the answer is yes, the report is actionable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
