TRACE
Responsible disclosure
Use this checklist for a simulated report or a real program only when you have followed its rules and stayed within scope.
Before sending
□ The affected asset is explicitly in scope□ The observed behavior was produced within the allowed rules□ No real user data or unnecessary secrets are included□ The impact is explained without exaggeration□ Reproduction steps are minimal and safe□ Evidence is redacted and sufficient to verify the report□ The report uses the program’s preferred private channel
Report outline
Title: [affected component] - [concise behavior]Summary:Describe the observed behavior and affected in-scope asset.Impact:Explain the plausible security consequence and assumptions.Reproduction:List the minimum authorized steps in the training or approved environment.Evidence:Attach only redacted information needed to confirm the issue.Suggested remediation:Offer a practical direction if you can do so confidently.
Avoid including credentials, personal data, unrelated findings or claims you cannot support.
More traces
Questions
What should happen before a vulnerability report is sent?
Read the organization’s security policy, confirm the asset and test are in scope, and follow its required reporting channel.
Should details be published immediately?
No. Follow the owner’s disclosure policy and coordinate privately. Do not publish sensitive details or data without authorization.