Responsible Disclosure Report Template

Summary

• Title:
• Affected product/version:
• Discovery date:
• Reporter contact:
• Authorization or program:
• Severity estimate and scoring rationale:

Scope and Safety

State the owned lab, open-source policy, or VRP authorization. Record stop conditions followed, testing limits, and confirmation that no unrelated data or systems were accessed.

Technical Detail

• Security property violated:
• Preconditions:
• Affected component and trust boundary:
• Reproduction environment:
• Minimal reproduction steps:
• Expected result:
• Observed result:
• Sanitized evidence and hashes:

Impact

Separate demonstrated impact from plausible impact. State required privileges, user interaction, tenant boundary, confidentiality/integrity/availability effect, and limiting controls.

Root Cause and Variants

• Root cause:
• Related code paths or variants:
• Why existing controls did not prevent or detect it:

Remediation

• Recommended fix:
• Defense-in-depth controls:
• Regression tests:
• Detection opportunities:
• Compatibility and rollout risks:

Timeline