Overview
A high-quality report includes remediation guidance — how to fix the finding — adding value beyond just reporting the problem. This lesson covers remediation in the report.
Learning objectives
- Explain including remediation in a report.
- Describe actionable, specific remediation guidance.
- Connect remediation to report quality and goodwill.
Core concept
Remediation guidance in the report tells the organization how to fix the finding: the root cause and a specific, actionable fix (e.g. "enforce per-object ownership checks on the endpoint" for BOLA, "use parameterized queries" for SQLi), drawing on the concrete defenses from the web-security path. Including remediation adds value beyond identifying the problem — it helps the organization fix it efficiently and demonstrates the researcher's expertise and good faith. While the organization ultimately decides the fix, actionable guidance improves the report's quality and the researcher's reputation.
How it works
For the finding, the researcher states the root cause (why it occurs) and a specific fix tied to it, based on the established defenses: per-object/role authorization for access-control flaws, parameterization for injection, output encoding for XSS, allowlisting/isolation for SSRF, correct configuration/headers, etc. The guidance is actionable (something the organization can implement) and specific to the finding, not generic. This helps the organization remediate efficiently and shows the researcher understands the issue deeply. Including good remediation is a mark of a high-quality report and builds goodwill with the program — even though the organization makes the final remediation decision.
Practical example
For the BOLA finding, the report's remediation states: "Root cause: the endpoint returns the invoice based on the id without verifying ownership. Fix: enforce a server-side check that the authenticated user owns (or is authorized for) the requested invoice, on this and all object-referencing endpoints; apply default-deny authorization." This specific, actionable guidance, tied to the root cause and drawing on the authorization defenses, helps the organization fix the issue and demonstrates the researcher's expertise — elevating the report's quality.
Cybersecurity relevance
Including remediation guidance elevates a bug bounty report from "here's a problem" to "here's a problem and how to fix it" — adding value, helping the organization remediate efficiently, and building the researcher's reputation and goodwill with the program. It draws on the concrete defenses from the web-security path and reflects the remediation emphasis from the reporting lessons. While organizations decide the actual fix, actionable, accurate guidance is a hallmark of a high-quality report and a skilled researcher. It contributes to a positive program relationship and the ultimate goal — getting vulnerabilities fixed.
Common mistakes
- Omitting remediation, leaving the report as just a problem statement.
- Generic advice ("fix the vulnerability") not tied to the specific root cause.
- Overstepping by dictating implementation rather than offering actionable guidance.
Key takeaways
- Remediation guidance states the root cause and a specific, actionable fix (tied to the finding), drawing on established defenses (authorization, parameterization, encoding, etc.).
- It adds value beyond identifying the problem, helps the organization fix efficiently, and demonstrates expertise and good faith.
- Including good remediation is a hallmark of a high-quality report and builds reputation/goodwill; the organization makes the final fix decision.
Check your understanding
- What should remediation guidance in a report include to be actionable?
- How does including good remediation guidance benefit both the organization and the researcher?