Module 3 · Getting in legally Lesson 9 of 15
Writing up a finding like a professional
A finding has five parts: what the issue is, how it can be exploited, what the impact would be, how to fix it, and how urgent it is. The fix and the urgency are what the reader acts on.
The concept
A security report is written for two people at once: the engineer who must fix it, and the manager who must decide how urgent it is. Structure it as title, summary, impact in business words, reproduction steps, evidence, and the fix. Write the impact in terms of what data or access is lost, not in jargon.
Include the exact request and response, the version of the software, and the minimum steps to reproduce. Then calibrate the severity honestly — critical for remote code execution or data exposure, medium for something needing an authenticated user and unusual conditions — because a report that calls everything critical gets read as noise.
Title: Session cookie missing the Secure flag
Risk: Medium - the cookie can cross plain HTTP on a hostile network
Evidence: the response headers, and the request showing http://
Impact: session theft on public Wi-Fi
Fix: set Secure; HttpOnly; SameSite=Lax
Retest: confirmed set after the change
Risk + evidence + impact + fix + retest. No names, no drama.Common mistakes
The mistake is a screenshot with no steps, which cannot be reproduced or fixed, and the second is a fix without a re-test. Say what you checked after the fix, and you become the junior whose reports are trusted, which is how the interesting work starts coming to you.
Worked example
A report that says "SQL injection found" gets ignored. A report that names the parameter, the impact on customer data and the two-line code fix gets scheduled this sprint.
Your practice task
Write up one issue from a practice machine in that five-part format, with a screenshot, and publish it as a portfolio write-up.
Do this before moving on. Reading a solution teaches the shape of it; typing it teaches you.
Key takeaway
A security report is written for two people at once: the engineer who must fix it, and the manager who must decide how urgent it is.
Keep your place in this course
A free account saves which lessons you have finished and unlocks the certificate. The lesson itself stays free to read.
Create free account or sign inCourse complete
You finished every lesson.
Your certificate is ready, and the projects you built are the proof to attach to an application.
Almost there
15 lessons left of 15
Finish every lesson to unlock the certificate. Each one ends in a practice task — do them and the final project brief writes itself.