Lion Cipher Lab
Write a vulnerability disclosure report
- AppSec / DevSecOps
- Beginner
- ~50 min
- Free · no account required
Why it matters
Sooner or later, if you work anywhere near technology, you will notice something broken and dangerous in software that is not yours -- a page that shows you data you should not see, a login that lets you in without a password, a form that leaks other people's details. What you do next matters enormously. Handled well, you quietly tell the people who can fix it, they fix it, and real users are protected before anyone gets hurt. Handled badly -- shouted on social media, sold, or exploited -- and you can cause the exact harm you spotted, or land yourself in legal trouble. The vulnerability…
What you'll learn
- understanding Coordinated Vulnerability Disclosure (CVD) and the ethics of reporting a flaw you find
- structuring a clear, responsible vulnerability disclosure report with the standard sections
- writing reproduction steps a stranger can follow to see the bug themselves
- describing real-world impact: what an attacker could actually do with the flaw
- assigning a CVSS-style severity so the vendor can prioritise the fix
- proposing a concrete suggested fix and a fair disclosure timeline
- using disclosure etiquette: report privately first, give time to fix, do not exploit or leak
Steps in this lab
- What a vulnerability is, and what disclosure means
- The vulnerability you will write up (read this once)
- The rules of the road: disclosure ethics before you write a word
- What a good disclosure report contains
- Sections 1 and 2: Summary and Affected version
- Sections 3 and 4: Reproduction steps and Proof of concept
- Sections 5 and 6: Impact and a CVSS-style severity
- Section 7: Suggested fix, disclosure timeline, and the full skeleton
- Why doing this well matters more than doing it fast