Overview
A validated finding needs evidence — proof that demonstrates it clearly. This lesson covers evidence in vulnerability validation.
Learning objectives
- Explain evidence for a validated finding.
- Describe clear, responsible evidence.
- Connect evidence to credible reporting.
Core concept
Evidence is the proof that demonstrates a validated finding is real and impactful — supporting the report so triage can confirm it. Good evidence includes the reproduction steps, the request/response or artifacts showing the issue, screenshots where helpful, and a clear demonstration of impact — all accurate, clear, and responsibly handled (sensitive data redacted/minimized, using the researcher's own test data). It applies the evidence-quality and responsible-handling principles from the ethical-hacking evidence-collection module to bug bounty: proof that is convincing yet minimal and safe.
How it works
For the validated finding, the researcher assembles evidence: the exact reproduction steps, the request/response demonstrating the issue (with sensitive values redacted), screenshots for visual clarity where useful, and evidence of the impact (shown safely, using their own test accounts, not real users' data). The evidence is clear (unambiguously demonstrates the finding), reproducible (triage can follow it), and minimal/responsible (only what's needed, sensitive data protected). This evidence is the backbone of the report — it's what lets the program's triage team verify and act on the finding. Strong evidence makes a finding credible; weak or excessive/irresponsible evidence undermines it.
Practical example
For a validated BOLA finding, the researcher assembles evidence: the reproduction steps (authenticated as test user A, the specific request accessing test user B's record), the request/response showing B's data returned (with sensitive values redacted), and a screenshot for clarity — all using their own test accounts. This clear, reproducible, responsibly-handled evidence lets triage confirm the finding. It demonstrates the issue and impact convincingly while protecting data — exactly what strong bug bounty evidence requires.
Cybersecurity relevance
Evidence is what makes a validated finding credible and actionable in bug bounty: clear, reproducible proof lets triage verify it (speeding acceptance and reward) and developers fix it. Responsible handling (redacting sensitive data, using the researcher's own test data, not exfiltrating real data) is an ethical and program-rule requirement — echoing the ethical-hacking evidence-collection principles. Weak evidence leads to rejected or delayed findings; excessive/irresponsible evidence (exposing real data) violates rules. Strong, responsible evidence is the backbone of the report and a core validation skill.
Common mistakes
- Weak/unclear evidence that doesn't convincingly demonstrate the finding.
- Over-collecting or exposing real sensitive data rather than minimal, redacted proof with test data.
- Missing reproduction steps that let triage verify the finding.
Key takeaways
- Evidence proves a validated finding is real and impactful: reproduction steps, request/response, screenshots, and safe impact demonstration.
- It must be clear, reproducible, and responsibly handled (sensitive data redacted/minimized, using the researcher's own test data).
- Strong, responsible evidence lets triage verify and act on the finding (speeding acceptance/reward); it applies the ethical-hacking evidence principles to bug bounty.
Check your understanding
- What should evidence for a validated finding include?
- Why must evidence be responsibly handled (redacted, test data) rather than exposing real sensitive data?