Documentation
README
REPORT WRITING
Impact-first. Human tone. No theoretical language. Triagers are people.
THE MOST IMPORTANT RULE
Never use "could potentially" or "could be used to" or "may allow". Either it does the thing or it doesn't. If you haven't proved it, don't claim it.
BAD: "This vulnerability could potentially allow an attacker to access user data."
GOOD: "An attacker can access any user's order history by changing the user_id
parameter to the target user's ID. I confirmed this using two test accounts:
attacker@test.com (ID 123) successfully retrieved victim@test.com (ID 456)
orders, including their shipping address and payment method last 4 digits."
PERSISTENCE RULE
This is the opening of the README. Read the full README on GitHub.