Images are AI-generated illustrations, not documentary photographs or product screenshots.
Security finding report: confirm authority and reporting route
Use the policy for the actual asset owner and the scope of your engagement. A platform listing does not grant permission for unrelated systems. HackerOne’s own policy illustrates why third-party and customer infrastructure can be excluded. If authorization is unclear, do not test. A good report starts with work performed within legitimate boundaries.
Describe observed behavior
State the affected asset, relevant environment and what you verified. Distinguish observation from possible consequences. Avoid exaggerating severity or claiming a full compromise based on limited evidence. Use the minimum detail needed for an authorized maintainer to understand the issue. Do not access additional private records merely to make the finding seem more impressive.
Provide safe reproduction context
Follow the owner’s evidence requirements and approved channel. Include necessary steps without publishing sensitive values or unnecessarily harmful payloads. Redact private material appropriately and keep originals protected where required. If sensitive information was encountered accidentally, stop and follow the policy’s contact process. Do not upload evidence to public repositories or unapproved AI tools.
Explain impact and limitations
Describe what the observed behavior could affect under stated conditions. Note requirements such as an authorized account or specific configuration. Suggest defensive remediation where you have a sound basis, but avoid pretending to know the owner’s entire architecture. A report should help prioritize and reproduce the finding, not pressure the recipient through threats or invented worst-case claims.
Respect follow-up and disclosure terms
Respond through the approved channel and verify fixes only when authorized. Publication and reward eligibility are separate issues; a disclosure program does not guarantee payment. Keep communication factual and preserve agreed confidentiality. Responsible reporting aims to reduce harm through useful evidence, not to create a dramatic public demonstration at someone else’s expense.
Sources and further reading
HackerOne: its own security testing policy and scope
GitHub Docs: secure workflow use and secrets