Every report has the same structure, written in Markdown (with a live preview).
| Field | What to write |
|---|---|
| Title | Specific and short: what is wrong where. “Invoices of other customers readable via /export” beats “IDOR”. |
| Affected asset | One of the program’s in-scope assets. |
| Weakness (CWE) | The closest CWE. Search by name (“IDOR”, “XSS”) or number. |
| Severity (CVSS 4.0) | Pick the base metrics; the score is calculated with the FIRST algorithm. |
| Description | The vulnerability and where it lives. |
| Impact | What a real attacker could achieve, and against whom. |
| Environment | Browser, OS, app version, the test accounts you used. |
| Proof of concept | Numbered steps the team can follow with their own test accounts. |
| Attachments | Up to 5 files of 8 MB: screenshots, a short recording, HTTP logs or scripts. |
Scores map to severities: 0 none, 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical. The program team may re-score after triage; your original vector stays in the timeline.
Files are checked by their content, not their name: images, PDF, ZIP, MP4/WebM and text files (logs, HTTP exchanges, scripts) are accepted. They are only ever served as downloads and are visible to you, the program team and RootBounty staff.
| Status | Meaning |
|---|---|
| Submitted | Waiting for the team. |
| Triaged | The team is looking at it. |
| Accepted | Valid finding — counts as certified. Bounties are awarded from here. |
| Resolved | Fixed — certified. |
| Duplicate / Informative / Not applicable | Closed with a reason you can read. |
A closed report can be made public at two levels:
| Level | Who decides | What is public |
|---|---|---|
| Title | The program team | Title and severity on hacktivity. |
| Full report | Both: one side proposes, the other agrees | Description, impact, environment, proof of concept, CVSS, CWE and the public timeline, on its own page linked from hacktivity. Attachments and internal notes are never published. |
Either side can withdraw a proposal, decline it, or later take a fully public report back to title-only.