A vulnerability that is not clearly reported does not get fixed. A good report has five parts.

1. Summary

One or two sentences: the bug class, the affected endpoint, and the impact in business terms ("an unauthenticated attacker can read any user's messages").

2. Reproduction steps

Numbered, exact, copy-pasteable. Include the full request and the relevant part of the response.

1. Log in as a low-privileged user.
2. Send: GET /api/messages?userId=1
3. Observe another user's messages in the response.

3. Evidence

Request/response pairs, screenshots, or a short screen recording. Redact real secrets.

4. Impact

What an attacker gains and at what scale. Distinguish "one record" from "the whole table".

5. Remediation

A concrete, framework-appropriate fix — "enforce an ownership check: message.user_id === session.user_id" — not just "validate input".