What every finding needs
Write each finding to the same shape so readers know where to look:
Title — what and where (e.g. “SQL injection in /app/login”). Severity — a rating, usually a CVSS score out of 10. Impact — what it means for the business, in plain language. Steps to reproduce — the exact request/payload, so anyone can confirm it. Remediation — the concrete fix. Evidence — the response or flag that proves it.
Severity is commonly scored with CVSS (Common Vulnerability Scoring System), which turns factors like attack vector and impact into a 0–10 number and a band from Low to Critical — a shared language so a “9.8” means the same to everyone.