High quality reports result in higher bounties and happier security teams. The best vulnerability reports provide security teams with all the information needed to verify and validate the issue. Now security teams can create their own custom report templates for hackers.
Enter customizable Report Templates from stage left, thanks to your friendly HackerOne engineering team.
What is a Report Template?
Instead of the report submission form being an empty white box, a Report Template customized by the security team will prompt hackers for the details they need.
The idea is simple: Security teams can create a (Markdown powered) template and when a hacker submits a new report, that template is pre-loaded, which can then request certain types of information. To add a Report Template, just navigate to Team Settings > Program > Submission Form, add the template to the box and click Update.
Hacker submitting reports to your program will then be greeted with a pre-populated Issue information box, assuming no report draft has previously been saved.
Here is an example template:
> Thanks for submitting a report! Please replace *all the [square] sections below with the pertinent details. You can remove this paragraph before you submit.*
Summary: [add summary of the vulnerability]
App Version: [add app version here]
App OS: [add OS here and version]
Steps to reproduce:
[add step]
[add step]
As you can see, this template makes it clear what information the hacker is expected to submit.
When creating templates, here are some useful tips:
- At the top of your report template make it clear how they fill in the key pieces. We recommend asking hackers to replace the items in [square brackets] like in the example above.
- Ask for key details about the platforms being used such as operating system, browser, and associated version numbers.
- Ask for details about the application such as version number, platform, and more.
- Ask for additional pieces information such as log files, code, screenshots, or other related material.
- Try to ask for the key details but don’t make your report template too long otherwise some hackers may get a little tired filling it in.
We are confident Report Templates will be helpful in improving the overall quality of report.
Harnessing Report Templates
Adding a Report Template is simple. Just click on Team Settings -> Program -> Submission Form and add the template to the box.
You can also read our help documentation for more information on using this feature.
Enjoy!
HackerOne is the #1 hacker-powered security platform, helping organizations find and fix critical vulnerabilities before they can be criminally exploited. As the contemporary alternative to traditional penetration testing, our bug bounty program solutions encompass vulnerability assessment, crowdsourced testing and responsible disclosure management. Discover more about our security testing solutions or Contact Us today.