Bug Bounty Report Writing — Vocabulary and Language
Learn to write clear, effective bug bounty vulnerability reports.
0 / 10 completed
1 / 10
What is the 'reproduction steps' section of a bug bounty report?
Reproduction steps are a numbered, precise sequence that allows the security team to reproduce the vulnerability — e.g., '1. Log in as a standard user. 2. Navigate to /profile/edit. 3. Submit the following payload...' Without these, the report is likely to be rejected.
2 / 10
What is 'impact justification' in a bug bounty submission?
Impact justification explains the real-world consequences: 'This allows an attacker to access all user email addresses in the database' — helping the security team prioritise correctly.
3 / 10
What is 'severity justification' in a bug bounty report?
Severity justification explains the rationale for the severity rating — e.g., 'Rated High because it requires authentication, but allows full account takeover of any target user' — helping triage consistency.
4 / 10
What is a 'proof of concept' (PoC) in a vulnerability report?
A PoC proves the vulnerability is real and exploitable — typically a script, payload, or screen recording showing the attack working. A PoC dramatically increases report credibility and acceptance speed.
5 / 10
What is 'responsible disclosure timeline' in a bug bounty context?
The responsible disclosure timeline (typically 90 days) is the period the vendor has to fix the vulnerability before the researcher may publish full details publicly — balancing transparency with giving time to patch.
6 / 10
Sarah from the Security team replied to your PR draft with: 'This is a critical vulnerability. Please provide a clear reproduction steps section outlining how to trigger this issue.' What's the primary purpose of this request?
The term 'reproduction steps' in bug bounty reports is crucial. It forces you to clearly define the exact actions needed by someone else (or even yourself later) to trigger and observe the vulnerability. It's not about explaining impact or suggesting fixes; it's about demonstrating that the issue *can* be reliably recreated. Providing this detail allows for independent verification.
7 / 10
Mark, a senior developer, sent you this Slack message after reviewing your bug bounty report: 'The impact justification is weak here. You state that the exposed data could be used for targeted phishing attacks, but don't quantify the potential damage or scope of those attacks.' What does impact justification primarily focus on?
'Impact justification' isn't about deep technical details. It's about translating a technical vulnerability into tangible business risk. You need to estimate the potential damage – how many users might be affected? What kind of data could be stolen? How much financial loss could result? A strong justification demonstrates the severity and urgency of the issue.
8 / 10
You're writing a PR description for a bug bounty submission related to an SQL injection vulnerability. The report includes a working PoC script. Which of the following best describes the purpose of this proof of concept?
A 'proof of concept' (PoC) serves a very specific function: to *prove* that something is vulnerable. It's typically a minimal example – a script or command – that reliably demonstrates the exploit. The goal isn't to provide a full fix or analyze the database; it's simply to show that the vulnerability exists and can be triggered.
9 / 10
David asks you to update the bug bounty report with a timeline for responsible disclosure. What is this typically referring to?
'Responsible disclosure' dictates a structured approach to vulnerability reporting. It acknowledges that immediate public disclosure can be harmful (allowing attackers more time), so there's a defined timeline – usually between discovery and public release – to allow for mitigation efforts, coordinate with the vendor, and ensure a controlled response. This period is critical for minimizing risk.
10 / 10
You've identified a cross-site scripting (XSS) vulnerability in a web application. During the bug bounty review process, you notice the report mentions that the vendor is requesting 'further investigation' regarding the potential impact. What does this likely mean?
When a vendor requests 'further investigation,' they're usually interested in quantifying the risk. They want to know how easily an attacker could leverage this XSS to compromise users or steal data. This goes beyond just demonstrating the vulnerability; it involves assessing its exploitability and potential consequences – essentially, understanding the *impact* of the vulnerability.
What will I learn from the "Bug Bounty Report Writing — Vocabulary and Language" exercise?
Learn to write clear, effective bug bounty vulnerability reports.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall required.
How many questions are in this exercise?
This set contains 10 multiple-choice questions, each with a detailed explanation shown after you answer.
Do I need to create an account to track my progress?
No account is required. Your progress bar and score reset each time you reload the page, but you can retry the exercise as many times as you like.
Who is this Security Disclosure Language exercise for?
This exercise is built for IT professionals and non-native English speakers who need to read, write, and discuss security disclosure language topics confidently at work.
What happens if I answer a question incorrectly?
You will see the correct answer highlighted along with a detailed explanation of why it is correct -- so every wrong answer becomes a learning moment, not just a lost point.
Can I retry this exercise?
Yes -- click "Try again" on the results screen at any time to reset your score and go through all the questions again.
How long does this exercise take to complete?
Most learners finish all 10 questions in under 10 minutes, since each question is answered by clicking a single option.
Where can I find more Security Disclosure Language exercises?
See the full Security Disclosure Language exercises hub for more vocabulary drills on this topic.
Is this exercise mobile-friendly?
Yes -- the exercise works on any device with a modern browser, including phones and tablets, with no app download required.