Overview
A bug bounty report's title is the first thing triage sees — a clear, specific title sets the tone for the whole report. This lesson covers writing effective titles.
Learning objectives
- Explain the role of the report title.
- Describe what makes a title clear and specific.
- Connect a good title to effective triage.
Core concept
The title is a concise, specific summary of the finding — ideally conveying the vulnerability type, the affected component/endpoint, and a hint of impact. A good title (e.g. "Broken object-level authorization on invoice endpoint exposes other users' invoices") lets triage immediately understand what the report is about and its likely severity. A vague title ("Bug found" or "Security issue") forces triage to dig in to understand it, slowing the process and creating a poor first impression.
How it works
The researcher writes a title that captures the essence: what the vulnerability is (type), where it is (component/endpoint), and, ideally, what it enables (impact). This lets the triage team categorize and prioritize the report at a glance. Titles should be specific (naming the actual vulnerability and location) rather than generic. A clear, informative title improves triage efficiency and signals a well-prepared report — setting a professional tone that carries through the summary, steps, impact, evidence, remediation, and severity that follow.
Practical example
Compare titles for the same finding: a poor title — "Found a bug in your API" — tells triage almost nothing. A strong title — "IDOR/BOLA in GET /api/invoices/{id} allows any user to read others' invoices" — immediately conveys the type (IDOR/BOLA), location (the invoice endpoint), and impact (reading others' data). The strong title lets triage categorize and prioritize it instantly and signals a quality report. Writing the specific, informative title set the whole report up for efficient handling.
Cybersecurity relevance
The title is the triage team's first impression and their basis for quickly categorizing and prioritizing a report — a clear, specific title (type + location + impact) speeds triage and signals professionalism, while a vague one slows handling and undermines confidence. In bug bounty, where triage teams process many reports, a good title helps a valid finding get the attention it deserves. It reflects the clear-communication emphasis from the reporting lessons across the paths. A strong title is a small but meaningful factor in a report's effective handling and the researcher's standing.
Common mistakes
- Vague titles ("bug", "security issue") that convey nothing specific.
- Omitting the vulnerability type, location, or impact from the title.
- Overly long or unclear titles that don't summarize crisply.
Key takeaways
- The title is a concise, specific summary conveying the vulnerability type, affected component/endpoint, and a hint of impact.
- A clear title (e.g. "BOLA on invoice endpoint exposes others' invoices") lets triage instantly categorize and prioritize; a vague one slows handling.
- It's the first impression and signals professionalism; a strong title helps a valid finding get proper attention (reflecting clear-communication principles).
Check your understanding
- What three things should a good report title convey?
- Why does a clear, specific title improve triage and the report's reception?