Overview
The report summary gives triage a concise overview of the finding before the details. This lesson covers writing an effective summary.
Learning objectives
- Explain the role of the summary.
- Describe what a good summary contains.
- Connect the summary to clear communication.
Core concept
The summary is a short overview (a few sentences) that explains the finding before the detailed steps: what the vulnerability is, where it occurs, and what impact it has — in plain, clear language. It lets triage quickly grasp the finding's nature and significance without yet reading the full reproduction. A good summary is clear and complete enough to convey the finding on its own, setting context for the detailed sections (steps, impact, evidence) that follow.
How it works
The researcher writes a summary that concisely states the vulnerability type, the affected component/endpoint, how it works at a high level, and its impact. This gives triage the big picture first, so they read the detailed steps with context. The summary complements the title (which is one line) by adding a bit more explanation. It should be self-contained — a reader should understand the finding's essence from the summary alone — and written clearly for the triage audience. A strong summary makes the whole report easier to follow and evaluate.
Practical example
For the BOLA finding, a summary might read: "The GET /api/invoices/{id} endpoint returns an invoice based on the id parameter without verifying the requester owns it. As a result, any authenticated user can read other users' invoices by changing the id, exposing sensitive financial data across all users." In a few sentences, triage understands the vulnerability, its location, how it works, and its impact — before reading the detailed steps. The summary framed the finding clearly and set context for the rest.
Cybersecurity relevance
The summary is where triage grasps the finding's essence and significance quickly, before the details — clear, complete summaries speed evaluation and improve comprehension, while vague or missing summaries force triage to piece the finding together from the steps. In bug bounty's high-volume triage, a good summary helps a valid finding be understood and prioritized correctly. It reflects the clear-communication and executive-summary principles from the reporting lessons (a summary for the reader to grasp the whole quickly). A strong summary is a hallmark of a professional, high-quality report.
Common mistakes
- No summary, forcing triage to infer the finding from the steps.
- Vague summary that doesn't clearly state the vulnerability, location, and impact.
- Overly technical or long summary that buries the essence.
Key takeaways
- The summary is a short, self-contained overview stating what the vulnerability is, where it occurs, and its impact, in plain language, before the detailed steps.
- It lets triage quickly grasp the finding's nature and significance, setting context for the detailed sections.
- Clear, complete summaries speed evaluation and signal a quality report (reflecting clear-communication/summary principles); vague or missing ones slow triage.
Check your understanding
- What should a report summary convey, and why before the detailed steps?
- Why should the summary be self-contained (understandable on its own)?