2024 Methodology: Reporting

Standard vulnerability documentation and payout structures

📝 Documenting Vulnerabilities (2024)

Reporting is where the bug is converted to a bounty. A high-quality report helps triagers validate issues quickly.

📝 Report Structure

Every report submitted should contain:

  1. Title: Structured like [Vulnerability Type] in [Component] leads to [Impact].
  2. Description: Concise summary of the vulnerability.
  3. Steps to Reproduce: 1-indexed, step-by-step description to reproduce.
  4. Proof of Concept: Command line or script to demonstrate the exploit.
  5. Remediation: Steps the developer should take to resolve the flaw.

📊 CVSS Severity (CVSS v3.1)

We use the CVSS v3.1 calculator to define severity (Low, Medium, High, Critical) mathematically.

🔗 Navigation