Overview
The report's evidence substantiates the finding — proof that it is real. This lesson covers evidence in the report.
Learning objectives
- Explain the role of evidence in the report.
- Describe including clear, responsible evidence.
- Connect evidence to triage verification and credibility.
Core concept
Evidence in the report is the proof that demonstrates the finding — supporting the steps and impact so triage can verify it. It includes request/response captures, screenshots, and other artifacts that clearly show the vulnerability and its impact — all accurate, clear, and responsibly handled (sensitive data redacted, using the researcher's own test data), from the validation evidence lesson and the ethical-hacking evidence principles. Strong evidence makes the finding credible and verifiable; weak or irresponsible evidence (exposing real data) undermines the report.
How it works
The researcher includes evidence that clearly demonstrates the finding alongside the steps: the request/response showing the issue (with sensitive values redacted), screenshots for visual clarity where helpful, and any artifacts proving the impact — all using their own test accounts/data, not real users'. The evidence is clear (unambiguously shows the finding), reproducible (aligns with the steps), and responsible (minimal, redacted). It lets triage confirm the finding quickly and confidently. Including strong, responsible evidence is essential — it's the proof behind the claim; without it, triage may be unable to verify, and with irresponsible evidence (real data exposed), the report violates rules and harms trust.
Practical example
For the BOLA finding, the report's evidence includes the GET /api/invoices/1002 request and the response showing test user B's invoice returned (with sensitive values redacted), plus a screenshot for clarity — all using the researcher's own test accounts. This clearly demonstrates the finding, aligns with the steps, and protects data. Triage can confirm the finding from the evidence quickly. The clear, responsible evidence substantiated the report and maintained credibility and rule-compliance.
Cybersecurity relevance
Evidence substantiates the finding for triage — clear, reproducible proof enables fast, confident verification (speeding acceptance and reward), while responsible handling (redacted, test data, no real-user data exposure) is an ethical and program-rule requirement (echoing the validation evidence and ethical-hacking evidence-collection lessons). Weak evidence leads to delayed/rejected findings; irresponsible evidence (exposing real data) violates rules and harms trust and the researcher's standing. Strong, responsible evidence is the backbone of a credible report and directly affects how a finding is handled — a core reporting skill.
Common mistakes
- Weak/unclear evidence that doesn't convincingly demonstrate the finding.
- Exposing real sensitive data instead of redacted proof using test data.
- Evidence that doesn't align with the steps, confusing triage.
Key takeaways
- Evidence substantiates the finding: request/response captures, screenshots, and artifacts showing the vulnerability and impact, aligned with the steps.
- It must be clear, reproducible, and responsibly handled (sensitive data redacted, using the researcher's own test data).
- Strong, responsible evidence enables fast triage verification (acceptance/reward) and maintains credibility and rule-compliance; weak or irresponsible evidence undermines the report.
Check your understanding
- What evidence should a report include, and how should sensitive data be handled?
- Why does strong, responsible evidence matter for triage verification and the researcher's standing?