WHY ENGLISH?
Help defenders reproduce the issue without creating unnecessary harm
Use the routes to follow the owner's policy, identify the vulnerable product, document a minimal safe reproduction, explain impact without exaggeration and coordinate private follow-up responsibly.
Open the full contents · See the How English Works hub
Full contents
Check authority
Identify target
Show evidence
Explain impact
Coordinate safely
Practice and next steps
Practice and next steps
Practice and next steps
Practice and next steps
Practice and next steps
A vulnerability disclosure report tells a system owner or coordinator about a suspected security weakness clearly enough for responsible verification and remediation. English matters because the difference between observed behaviour, a proposed attack path and a confirmed impact must stay visible. Vague claims waste response time; excessive operational detail shared in the wrong place can increase risk.
People searching for how to report a security vulnerability, responsible disclosure, vulnerability report template, bug bounty report or proof of concept need more than a dramatic finding. They need the owner's current disclosure policy, exact product scope, safe reproducible evidence, impact reasoning, contact details and a coordinated communication plan.
Singapore's Cyber Security Agency page on responsible vulnerability disclosure, updated 11 September 2026, says SingCERT can coordinate between informers and system owners and links its reporting route. The CISA vulnerability reporting form asks for a concise title, vulnerable product and versions, vendor contact history, independently reproducible description, security impact, proof-of-concept material, public-disclosure status and exploitation knowledge. Always follow the specific owner's policy and applicable law.
Use the reporting map policy, authorisation, scope, target, owner, product, version, environment, endpoint, prerequisite, account, configuration, steps, request, response, observation, expectation, proof, impact, attacker, victim, data, privilege, severity, workaround, contact, embargo, remediation, retest and credit.
Read the disclosure policy first
Begin the system owner's authorised reporting and testing rules inside explicit authority and scope.
Good intent is not enough when technical curiosity is treated as permission.
Stop, check the policy and follow the stated channel, scope and limits.
Scope example. The researcher stops at proof and uses the listed security contact.
Did You Know? Singapore's CSA says responsible vulnerability disclosure informs system owners so they can mitigate or remove risk, and SingCERT can coordinate between informers and owners. This is why the system owner's authorised reporting and testing rules must stay attached to evidence and scope.
Confirm the target is in scope
Write the domain, product or service covered by the policy so another defender can reproduce it safely.
Verification slows when a related asset is assumed included.
Use exact nouns and match exact host, application and owner.
Reproduction example. The test covers the public portal but not its third-party payment page.
The shortest reliable proof is usually stronger than a large scan dump.
Respect prohibited activity
Preserve actions the policy or law does not authorise as evidence while removing unnecessary exposure.
The report creates new risk when impact demonstration becomes data access or disruption.
Redact, minimise and use the least harmful evidence.
Evidence example. The report proves access-control failure without downloading other users' records.
Screenshots help with orientation but rarely replace requests, responses and steps.
Use the approved channel
Bound the place designed to receive sensitive reports to what the test actually established.
Severity becomes theatre when the finding is sent through public support or social media.
Separate observation, inference and use the named form, email or coordinator.
Impact example. The encrypted report goes to the published security contact.
Could, observed and confirmed are technical safety words, not timid prose.
Protect secrets in transit
Coordinate credentials, tokens and private data appearing in evidence through private, factual communication.
Users may be harmed when screenshots expose live secrets.
Follow the reporting route and redact and transfer securely.
Coordination example. The token is masked except for the characters needed to distinguish it.
Remediation, disclosure, recognition and retest are related but distinct conversations.
Write a precise title
Begin the weakness, affected feature and product inside explicit authority and scope.
Good intent is not enough when the title says critical bug.
Stop, check the policy and name the observable issue concisely.
Scope example. Authorisation bypass in invoice-download endpoint on Product 4.2.
Testing boundaries protect users, systems and the researcher.
Name the vendor and product
Write the responsible developer or service and exact offering so another defender can reproduce it safely.
Verification slows when brand family and component are mixed.
Use exact nouns and use official product names.
Reproduction example. The report identifies the cloud administration console rather than the mobile app.
Did You Know? Singapore's CSA says responsible vulnerability disclosure informs system owners so they can mitigate or remove risk, and SingCERT can coordinate between informers and owners. This is why the responsible developer or service and exact offering must stay attached to evidence and scope.
State affected versions
Preserve the releases tested and believed affected as evidence while removing unnecessary exposure.
The report creates new risk when one successful test becomes all versions.
Redact, minimise and separate tested, inferred and unknown ranges.
Evidence example. Version 4.2.1 is confirmed; earlier versions were not tested.
Screenshots help with orientation but rarely replace requests, responses and steps.
State the environment
Bound the platform, region, browser, device or deployment context to what the test actually established.
Severity becomes theatre when reproduction depends on an unstated condition.
Separate observation, inference and record material environment details.
Impact example. The issue appears in the production EU tenant with feature X enabled.
Could, observed and confirmed are technical safety words, not timid prose.
State required access
Coordinate the account, role and privileges needed before testing through private, factual communication.
Users may be harmed when the reader cannot tell whether authentication is required.
Follow the reporting route and name the minimum prerequisite.
Coordination example. A normal authenticated customer account is sufficient.
Remediation, disclosure, recognition and retest are related but distinct conversations.
State configuration prerequisites
Begin settings or features needed to reach the issue inside explicit authority and scope.
Good intent is not enough when default and optional paths are confused.
Stop, check the policy and list only material conditions.
Scope example. Shared-project mode must be enabled for the vulnerable route.
Testing boundaries protect users, systems and the researcher.
Separate discovery from reproduction
Write the original observation versus the shortest reliable proof so another defender can reproduce it safely.
Verification slows when a long exploratory log obscures the issue.
Use exact nouns and write a clean minimal sequence.
Reproduction example. Five numbered actions reproduce the failure from a fresh account.
The shortest reliable proof is usually stronger than a large scan dump.
Number the steps
Preserve the exact sequence another team can follow as evidence while removing unnecessary exposure.
The report creates new risk when actions and observations blend into prose.
Redact, minimise and use one action per step.
Evidence example. Create account, open project, replace identifier, submit request, observe response.
Did You Know? Singapore's CSA says responsible vulnerability disclosure informs system owners so they can mitigate or remove risk, and SingCERT can coordinate between informers and owners. This is why the exact sequence another team can follow must stay attached to evidence and scope.
Use stable identifiers
Bound the endpoint, object and parameter involved to what the test actually established.
Severity becomes theatre when screen position is the only locator.
Separate observation, inference and name route, field and object type.
Impact example. The report identifies the resource ID parameter in the download request.
Could, observed and confirmed are technical safety words, not timid prose.
Show a minimal request
Coordinate the smallest input demonstrating the behaviour through private, factual communication.
Users may be harmed when a full automated scan dump overwhelms the reader.
Follow the reporting route and retain only relevant headers and values.
Coordination example. The proof includes the modified path and necessary session context.
Remediation, disclosure, recognition and retest are related but distinct conversations.
Show the relevant response
Begin the output that confirms the observation inside explicit authority and scope.
Good intent is not enough when a screenshot replaces machine-readable evidence.
Stop, check the policy and quote the essential status, field or event.
Scope example. The response returns another account's invoice metadata with status 200.
Testing boundaries protect users, systems and the researcher.
State expected behaviour
Write what the system should have done under its security model so another defender can reproduce it safely.
Verification slows when the reader must infer the control.
Use exact nouns and write the intended boundary.
Reproduction example. The service should return a denial when the object is not owned by the requester.
The shortest reliable proof is usually stronger than a large scan dump.
State observed behaviour
Preserve what happened in the controlled test as evidence while removing unnecessary exposure.
The report creates new risk when impact language replaces the observation.
Redact, minimise and report the direct result.
Evidence example. The service returned the object after only its numeric identifier changed.
Screenshots help with orientation but rarely replace requests, responses and steps.
Distinguish fact from hypothesis
Bound verified evidence versus plausible technical explanation to what the test actually established.
Severity becomes theatre when a suspected root cause is presented as confirmed.
Separate observation, inference and label inference and invite verification.
Impact example. The behaviour suggests missing object-level authorisation; source code was not available.
Did You Know? Singapore's CSA says responsible vulnerability disclosure informs system owners so they can mitigate or remove risk, and SingCERT can coordinate between informers and owners. This is why verified evidence versus plausible technical explanation must stay attached to evidence and scope.
Include timestamps
Coordinate when testing and communication occurred through private, factual communication.
Users may be harmed when changing systems make the sequence unclear.
Follow the reporting route and use explicit time zone and chronology.
Coordination example. The final confirming test ran at 14:32 Singapore time on the stated date.
Remediation, disclosure, recognition and retest are related but distinct conversations.
Preserve evidence integrity
Begin the original requests, responses and files supporting the claim inside explicit authority and scope.
Good intent is not enough when evidence is edited without record.
Stop, check the policy and retain originals and hashes where appropriate.
Scope example. The redacted copy is linked to a preserved original under controlled access.
Testing boundaries protect users, systems and the researcher.
Use screenshots selectively
Write visual context that helps locate the issue so another defender can reproduce it safely.
Verification slows when images become the only proof.
Use exact nouns and pair them with reproducible technical evidence.
Reproduction example. The screenshot shows the affected menu while the request log proves the boundary failure.
The shortest reliable proof is usually stronger than a large scan dump.
Use video selectively
Preserve timing or multi-step behaviour difficult to express otherwise as evidence while removing unnecessary exposure.
The report creates new risk when a large recording makes analysis slow.
Redact, minimise and provide a short labelled clip plus written steps.
Evidence example. The video shows a race condition while the report states the exact sequence.
Screenshots help with orientation but rarely replace requests, responses and steps.
Handle proof-of-concept code safely
Bound the smallest code needed for independent confirmation to what the test actually established.
Severity becomes theatre when a weaponised tool is supplied unnecessarily.
Separate observation, inference and limit scope, rate and destructive behaviour.
Impact example. The script tests one researcher-owned object and stops after confirmation.
Could, observed and confirmed are technical safety words, not timid prose.
Avoid unnecessary data access
Coordinate the minimum evidence needed to demonstrate the weakness through private, factual communication.
Users may be harmed when the researcher collects records to prove scale.
Follow the reporting route and use controlled accounts or synthetic data.
Coordination example. Two self-owned test accounts establish cross-account access.
Did You Know? Singapore's CSA says responsible vulnerability disclosure informs system owners so they can mitigate or remove risk, and SingCERT can coordinate between informers and owners. This is why the minimum evidence needed to demonstrate the weakness must stay attached to evidence and scope.
Avoid service disruption
Begin the proof that does not degrade availability inside explicit authority and scope.
Good intent is not enough when load is increased to show theoretical denial of service.
Stop, check the policy and describe the risk without executing harmful volume.
Scope example. One bounded request reveals missing rate control; no stress test is run.
Testing boundaries protect users, systems and the researcher.
Describe the attacker model
Write the access and capability a realistic attacker would need so another defender can reproduce it safely.
Verification slows when any internet user is claimed without prerequisites.
Use exact nouns and state starting conditions.
Reproduction example. An authenticated low-privilege user can alter the object identifier.
The shortest reliable proof is usually stronger than a large scan dump.
Describe the victim
Preserve the user, organisation or system whose security is affected as evidence while removing unnecessary exposure.
The report creates new risk when impact remains abstract.
Redact, minimise and name the protected interest.
Evidence example. Another tenant's billing metadata can be exposed.
Screenshots help with orientation but rarely replace requests, responses and steps.
Describe confidentiality impact
Bound information that may become visible to an unauthorised party to what the test actually established.
Severity becomes theatre when possible access is described as total breach.
Separate observation, inference and bound data type and reach.
Impact example. Invoice names and amounts are exposed; payment-card data was not observed.
Could, observed and confirmed are technical safety words, not timid prose.
Describe integrity impact
Coordinate data or actions that may be changed without authority through private, factual communication.
Users may be harmed when read access is assumed to permit modification.
Follow the reporting route and test or infer separately.
Coordination example. The tested endpoint was read-only, so modification remains unverified.
Remediation, disclosure, recognition and retest are related but distinct conversations.
Describe availability impact
Begin service loss or degradation plausibly caused inside explicit authority and scope.
Good intent is not enough when every error is labelled denial of service.
Stop, check the policy and state required scale and uncertainty.
Scope example. A single malformed file crashes one worker, while cluster-wide effect is unknown.
Did You Know? Singapore's CSA says responsible vulnerability disclosure informs system owners so they can mitigate or remove risk, and SingCERT can coordinate between informers and owners. This is why service loss or degradation plausibly caused must stay attached to evidence and scope.
Describe privilege impact
Write the boundary crossed between roles or accounts so another defender can reproduce it safely.
Verification slows when administrator compromise is claimed from limited access.
Use exact nouns and name the verified elevation.
Reproduction example. A project member can perform an owner-only export.
The shortest reliable proof is usually stronger than a large scan dump.
Describe user interaction
Preserve whether another person must click, open or approve something as evidence while removing unnecessary exposure.
The report creates new risk when automatic exploitation is implied.
Redact, minimise and state the required action.
Evidence example. The attack succeeds only after the victim opens the shared document.
Screenshots help with orientation but rarely replace requests, responses and steps.
Describe attack complexity
Bound conditions that make exploitation more or less reliable to what the test actually established.
Severity becomes theatre when one lab success is called trivial.
Separate observation, inference and report timing, knowledge and variability.
Impact example. The race succeeds intermittently and needs two concurrent requests.
Could, observed and confirmed are technical safety words, not timid prose.
Use severity systems carefully
Coordinate a structured score as one interpretation of impact through private, factual communication.
Users may be harmed when the reporter's score is treated as final authority.
Follow the reporting route and show vector and rationale if requested.
Coordination example. The report offers a provisional CVSS vector and leaves final scoring to the coordinator.
Remediation, disclosure, recognition and retest are related but distinct conversations.
Use weakness classifications carefully
Begin the CWE or other category that helps route analysis inside explicit authority and scope.
Good intent is not enough when a guessed label replaces the behaviour.
Stop, check the policy and prioritise reproducible description.
Scope example. The report suggests an authorisation weakness but keeps observed evidence central.
Testing boundaries protect users, systems and the researcher.
State active exploitation knowledge
Write whether the issue appears to be used outside testing so another defender can reproduce it safely.
Verification slows when absence of evidence becomes evidence of absence.
Use exact nouns and report what is known and unknown.
Reproduction example. No active exploitation was observed; external telemetry was unavailable.
Did You Know? Singapore's CSA says responsible vulnerability disclosure informs system owners so they can mitigate or remove risk, and SingCERT can coordinate between informers and owners. This is why whether the issue appears to be used outside testing must stay attached to evidence and scope.
State public-disclosure status
Preserve whether details have already appeared elsewhere as evidence while removing unnecessary exposure.
The report creates new risk when private and public timelines are mixed.
Redact, minimise and give links and dates if applicable.
Evidence example. A brief forum mention exists without reproducible details.
Screenshots help with orientation but rarely replace requests, responses and steps.
Record contact history
Bound who was notified, when and through which channel to what the test actually established.
Severity becomes theatre when silence is interpreted without delivery evidence.
Separate observation, inference and maintain a factual chronology.
Impact example. The first report, acknowledgement and requested follow-up are timestamped.
Could, observed and confirmed are technical safety words, not timid prose.
Set communication expectations
Coordinate how the reporter and owner will exchange updates through private, factual communication.
Users may be harmed when daily public pressure replaces coordination.
Follow the reporting route and request acknowledgement and a reasonable next point.
Coordination example. The reporter asks for confirmation of receipt and a status update after triage.
Remediation, disclosure, recognition and retest are related but distinct conversations.
Coordinate disclosure timing
Begin the responsible handling of publication while remediation proceeds inside explicit authority and scope.
Good intent is not enough when a universal deadline is applied regardless of circumstances.
Stop, check the policy and follow policy, risk and coordinator guidance.
Scope example. The parties agree to revisit publication after the fix reaches supported versions.
Testing boundaries protect users, systems and the researcher.
Protect affected users
Write the people who could be harmed by premature or incomplete disclosure so another defender can reproduce it safely.
Verification slows when credit and speed dominate safety.
Use exact nouns and minimise operational detail until mitigation is ready.
Reproduction example. The public advisory explains action without publishing exploit code.
The shortest reliable proof is usually stronger than a large scan dump.
Handle duplicate reports
Preserve an issue another reporter or team may already track as evidence while removing unnecessary exposure.
The report creates new risk when duplicate means useless work.
Redact, minimise and offer new evidence and accept coordinated ownership.
Evidence example. The second report adds an affected version and reliable reproduction.
Did You Know? Singapore's CSA says responsible vulnerability disclosure informs system owners so they can mitigate or remove risk, and SingCERT can coordinate between informers and owners. This is why an issue another reporter or team may already track must stay attached to evidence and scope.
Respond to clarification
Bound the questions needed for independent confirmation to what the test actually established.
Severity becomes theatre when the reporter repeats the conclusion.
Separate observation, inference and answer with evidence or mark unknown.
Impact example. A fresh account test confirms the prerequisite role.
Could, observed and confirmed are technical safety words, not timid prose.
Retest remediation
Coordinate whether the fix prevents the original behaviour without regression through private, factual communication.
Users may be harmed when a version note is treated as proof.
Follow the reporting route and repeat bounded steps on the fixed release.
Coordination example. The endpoint now returns denial for another account's object.
Remediation, disclosure, recognition and retest are related but distinct conversations.
Check bypass variants responsibly
Begin closely related paths that may share the weakness inside explicit authority and scope.
Good intent is not enough when testing expands without permission.
Stop, check the policy and ask before broadening scope.
Scope example. The owner authorises checks of two equivalent download routes.
Testing boundaries protect users, systems and the researcher.
Write the closure note
Write the final status, tested fix and remaining uncertainty so another defender can reproduce it safely.
Verification slows when resolved means every related risk is gone.
Use exact nouns and state version, retest and limits.
Reproduction example. The confirmed path is fixed in 4.2.2; untested legacy editions remain outside scope.
The shortest reliable proof is usually stronger than a large scan dump.
Discuss recognition respectfully
Preserve credit, anonymity or reward under the stated policy as evidence while removing unnecessary exposure.
The report creates new risk when recognition becomes leverage over safety.
Redact, minimise and state preference without conditioning cooperation.
Evidence example. The reporter requests a pseudonym if public acknowledgement occurs.
Screenshots help with orientation but rarely replace requests, responses and steps.
Keep a private research record
Bound the lawful, factual chronology of authorised work to what the test actually established.
Severity becomes theatre when notes contain unnecessary live data.
Separate observation, inference and store minimal evidence securely.
Impact example. The file records consent, tests, messages and deletion of sensitive artefacts.
Did You Know? Singapore's CSA says responsible vulnerability disclosure informs system owners so they can mitigate or remove risk, and SingCERT can coordinate between informers and owners. This is why the lawful, factual chronology of authorised work must stay attached to evidence and scope.
Write a calm executive summary
Coordinate the issue, affected scope, proof and consequence in a few sentences through private, factual communication.
Users may be harmed when alarm words replace information.
Follow the reporting route and lead with reproducible bounded facts.
Coordination example. A low-privilege user can read another tenant's invoice metadata by changing one identifier.
Remediation, disclosure, recognition and retest are related but distinct conversations.
Use a clean test account
Begin an environment that limits personal and operational exposure inside explicit authority and scope.
Good intent is not enough when ordinary accounts contain unrelated private data.
Stop, check the policy and create authorised synthetic conditions.
Scope example. Two dedicated accounts demonstrate the boundary safely.
Testing boundaries protect users, systems and the researcher.
Record rate and volume
Write how many requests were sent during confirmation so another defender can reproduce it safely.
Verification slows when the owner cannot assess operational effect.
Use exact nouns and state bounded test intensity.
Reproduction example. The proof used three manual requests and no automation.
The shortest reliable proof is usually stronger than a large scan dump.
Record failed attempts
Preserve tests that did not reproduce the behaviour as evidence while removing unnecessary exposure.
The report creates new risk when only successful trials are reported.
Redact, minimise and include material variability.
Evidence example. The issue appeared twice in five attempts under the stated timing.
Screenshots help with orientation but rarely replace requests, responses and steps.
Avoid persistence
Bound changes that survive after the test to what the test actually established.
Severity becomes theatre when proof leaves accounts, files or code behind.
Separate observation, inference and clean up authorised artefacts.
Impact example. The researcher removes the test share and confirms no scheduled task remains.
Could, observed and confirmed are technical safety words, not timid prose.
Avoid social engineering
Coordinate contact with people as part of attempted exploitation through private, factual communication.
Users may be harmed when a technical policy is assumed to authorise deception.
Follow the reporting route and exclude unapproved human targeting.
Coordination example. The researcher does not contact staff or request credentials.
Did You Know? Singapore's CSA says responsible vulnerability disclosure informs system owners so they can mitigate or remove risk, and SingCERT can coordinate between informers and owners. This is why contact with people as part of attempted exploitation must stay attached to evidence and scope.
Handle third-party ownership
Begin components or services controlled by another organisation inside explicit authority and scope.
Good intent is not enough when one disclosure channel is assumed to cover every party.
Stop, check the policy and identify the responsible owner or coordinator.
Scope example. The platform routes the payment-provider issue to its own security team.
Testing boundaries protect users, systems and the researcher.
Preserve legal boundaries
Write the jurisdictional and contractual limits relevant to the work so another defender can reproduce it safely.
Verification slows when a global service is treated as one permission space.
Use exact nouns and obtain qualified guidance when uncertain.
Reproduction example. Testing stops when ownership of the regional host cannot be confirmed.
The shortest reliable proof is usually stronger than a large scan dump.
Write for triage
Preserve the first responder who must route urgency and ownership quickly as evidence while removing unnecessary exposure.
The report creates new risk when the opening buries the product and effect.
Redact, minimise and lead with affected asset, proof and impact.
Evidence example. The first paragraph gives version, role, endpoint and verified cross-account access.
Screenshots help with orientation but rarely replace requests, responses and steps.
A worked example
A student finds that changing a number in a URL reveals data from a second test account. The first report says the entire platform is critically hacked, attaches an unredacted session token and posts the finding publicly before using the vendor's security channel.
A responsible report follows the policy, names the exact product and version, uses two self-owned accounts, provides five reproducible steps, separates observed cross-account reading from untested modification, redacts secrets, explains bounded impact and coordinates private retest.
English becomes part of cyber safety. Clear scope prevents accidental expansion; verbs such as observed, suggests and could preserve evidence levels; exact nouns and versions help defenders fix the right system quickly.
A practical checklist
- Current policy read
- Target and activity authorised
- Approved private channel used
- Product, version and environment exact
- Prerequisites stated
- Minimal steps reproducible
- Expected and observed behaviour separated
- Evidence redacted and preserved
- Impact bounded
- Fact distinct from hypothesis
- Timeline and disclosure status recorded
- Retest and closure documented
Advice for students, parents and young adults
Students should practise only in systems they own or are explicitly authorised to test, such as purpose-built security labs. Technical ability never substitutes for permission.
Parents can reinforce a valuable digital habit: when a child finds a surprising system behaviour, stop, avoid accessing other people's data, preserve minimal evidence and seek a safe adult or official reporting route.
This guide is not legal authorisation, a testing policy or incident-response instruction. Follow applicable law, the system owner's current policy, school or employer rules and qualified security guidance.
Frequently asked questions
Can I test any public website if I mean well?
No. Public accessibility is not permission to test. Use systems you own or activities explicitly authorised by the relevant policy and law.
How much proof is enough?
The minimum safe evidence that lets the owner independently confirm the issue, without unnecessary access, persistence, disruption or collection.
Should I publish immediately?
Follow the owner's policy and coordinate responsibly, considering remediation and user safety. If needed, use an appropriate coordinator.
Do I need a CVSS score?
Often not. A precise reproducible report is more important. If a score is requested, provide the vector and rationale as provisional.
What if the owner does not respond?
Keep the communication record and use an appropriate official coordinator or policy escalation route rather than increasing harmful testing.
Can screenshots replace steps?
Usually no. They can add context, but written reproducible steps and relevant request-response evidence are more useful.
The deeper English lesson
Vulnerability-report English is evidence-with-restraint language. It tells enough for verification while protecting scope, secrets, users and the difference between what happened and what might happen. Precision accelerates defence; restraint prevents the report becoming a new risk.
Useful next reading
Continue with reading a cybersecurity advisory, reading a personal data breach notification, writing a workplace incident report, writing a root cause analysis report, and the How English Works.
Continue reading: explore the English Learning Hub for related guides and reading routes.