/
How to Write a Good Submission

How to Write a Good Submission

What makes a quality bug bounty report with a high chance of acceptance and bounty?

To ensure a bug bounty report has a high chance of acceptance and qualifies for a maximum potential bounty, security researchers should focus on the following key elements:

  • Provide a Clear Proof-of-Concept (PoC): A well-documented PoC—such as a video, screenshot, or exploit code—is crucial. It allows triage analysts to quickly replicate and validate the security issue, reducing delays and unnecessary back-and-forth communication. If a report lacks a PoC, analysts will request one before it can be accepted - it is required. Please keep these videos concise yet detailed.

  • Demonstrate the Negative Impact: Simply mentioning a potential risk is not enough; you must clearly show it. For example, if reporting a Local File Inclusion, directly demonstrating partial content exposure safely will validate the severity. Chaining multiple vulnerabilities together (e.g., combining IDOR with XSS, or Broken Access Control with SQL injection) is highly recommended to prove a greater security risk and achieve a higher severity and payout.

  • Write Concisely and Clearly: Reports must be well-structured, direct, and easy to comprehend. Overly long reports that lack clear, direct details make the validation process difficult, whereas concise reporting speeds up triage and payout.

  • Verify the Program Scope: Before submitting, thoroughly read the Program Description, including the strictly defined Scope and Out of Scope sections. Reports regarding out-of-scope issues (such as Denial of Service, social engineering, or public API key exposure without negative impact) will typically be rejected or marked as Informational (P5) with no bounty.

  • Stay Engaged and Professional: Respond promptly to any questions from triage analysts in the report's comments section, as swift communication expedites validation. Maintaining a respectful attitude and demonstrating ingenuity builds strong rapport with the triage team, which is a key criteria for being invited to exclusive private programs.