Free template · No signup · Browser only
Bug bounty report template & Markdown builder
Turn verified finding notes into a report another researcher can reproduce. Start with a blank template or a filled example, describe the evidence behind your impact claim, then copy or download Markdown.
By CyberRouter · Updated October 13, 2026 · Suggest a correction
Build your report
Your draft stays in this tab. It is not uploaded, saved by this tool, or included in analytics or a share URL. Copy or download it before leaving; a reload clears the draft. Use redacted notes.
Name the affected feature and the demonstrated security impact.
Identify the tested asset and the program rule that permits this research.
Describe the observed defect in a few sentences. Separate observation from inference.
Include account roles, test data, permissions, and the starting state.
Write numbered steps that another researcher can repeat from the stated starting state.
State the access rule or other security property that should hold.
Record exactly what happened, including the result of your repeat test.
Explain who can do what, to which data or capability, under which conditions.
List redacted artifacts and what each proves. Attach the actual evidence through the program’s approved channel.
Suggest a control and checks for both permitted and rejected behavior, if you can support them.
Markdown preview
Bracketed sections still need your evidence. This formats your notes; it does not verify a vulnerability or predict a reward.
# [Affected feature, weakness, and demonstrated impact] ## Affected asset and scope [Asset, environment, and relevant program scope] ## Summary [Observed defect and the security boundary it crosses] ## Prerequisites [Accounts you control, roles, setup, and required conditions] ## Steps to reproduce 1. [Set up the permitted test state] 2. [Perform the minimum action that demonstrates the issue] 3. [Record the result and repeat from a clean state] ## Expected behavior [Expected security control or behavior] ## Observed behavior [Actual result and reproducibility, with evidence references] ## Demonstrated impact [Demonstrated consequence, affected role, constraints, and remaining uncertainty] ## Evidence references [Artifact name, relevant step, and the observation it supports] ## Remediation and retest notes (optional) [Optional correction and regression checks]
What belongs in a bug bounty report?
Give the receiving team enough information to reproduce the issue and judge the demonstrated impact. Name the affected asset, explain the starting conditions, and distinguish expected behavior from what you observed. Attach only relevant, redacted evidence through the program’s approved submission channel.
HackerOne’s reporting guidance emphasizes a clear title, reproducible steps, impact, and supporting material. Each program can ask for different fields, so use its own template and scope rules when submitting. This independent template is not endorsed by a bounty platform.
Filled example: an invoice authorization defect
This report describes our synthetic authorization-review exercise. Download and run its local Python fixture to inspect the original function, correction, and regression tests. It is a teaching example, not a real target, paid finding, or recorded AI result.
# Synthetic example: invoice lookup returns another test user’s invoice ## Affected asset and scope Local security-review.py teaching fixture. No live service or bounty program is involved. ## Summary The unscoped get_invoice function looks up an invoice by ID without checking its owner. The supplied user_id is unused. The stated policy permits only the invoice owner to read it. ## Prerequisites Download CyberRouter’s security-review.py fixture. Python 3 is sufficient. The fixture supplies synthetic users and invoices; no credentials or network access are needed. ## Steps to reproduce 1. Read the fixture’s owner-only access policy and invoice data. 2. Run python3 security-review.py to exercise the original and corrected functions. 3. Inspect the test of an invoice requested by a different user: the original lookup returns it. 4. Inspect the corrected lookup: its owner check rejects the same access and preserves the owner’s permitted access. ## Expected behavior A caller can retrieve an invoice only when the authenticated user owns that invoice. Unknown and unauthorized IDs do not return invoice data. ## Observed behavior In the synthetic fixture, the original function returns an invoice to a different user. The corrected function rejects that case. The included tests exercise both behaviors. ## Demonstrated impact Under the exercise’s owner-only policy, the original lookup crosses a user-to-user data boundary. The fixture establishes no production exposure, authentication bypass, write access, or bounty severity. ## Evidence references security-review.py: the original lookup, the owner-scoped correction, and their regression tests. Reference: https://cyberrouter.ai/guides/security-code-review/ ## Remediation and retest notes (optional) Scope the lookup to the authenticated owner. Retest the owner, another user, and a missing invoice. Add separate policy tests before extending this example to shared or delegated access.
Check the evidence before submitting
- Can a reviewer repeat the steps using only the prerequisites you wrote down?
- Does each impact claim point to an observation or artifact?
- Have you kept hypothetical extensions separate from demonstrated access?
- Are the tested asset and method within the current program’s scope?
- Have you removed secrets and unrelated personal data from the evidence?
If a model helped draft the report, use the AI-assisted report review guide to check for invented observations and unsupported severity claims.
Can this template be used with HackerOne or Bugcrowd?
Use the Markdown as a starting draft, then map its sections to the program’s required fields. Asset, weakness, severity, and attachments may have separate controls in the platform. Completing this template does not establish eligibility, severity, acceptance, or payment.
Does the report builder use AI or upload my notes?
No. This free tool formats text in your browser without a model request, upload, or saved draft. The copy and download buttons export only when you use them. Website analytics follow your preferences and do not collect report contents.
CyberRouter’s gateway is a separate service: when you deliberately send a model request, the selected provider processes that request under the applicable settings. Read the privacy guide before sending research material.
Add security context to your research workflow
Connect your own provider keys to CyberRouter and use eligible models with relevant security references. Start with the synthetic example and inspect what context was added.