Report Templates

Report templates provide a consistent structure for longer-form public research. They help reviewers confirm that each report states scope, method, findings, limitations, defensive value, and evidence-handling posture before publication.

Templates are intentionally conservative. A polished report should not feel like a proof-of-concept dump. It should read as a controlled technical artifact that helps defenders act and helps affected parties understand what has been claimed.

Vulnerability Report TemplateReusable structure for sanitized public vulnerability research reports.

Review Standard

A report cannot outsource judgment to a template. The template provides shape; release review determines whether the contents are accurate, safe, and useful.

Review language should identify who checks the artifact, what evidence is required, and what condition blocks publication. The public page does not need private workflow detail, but it does need a visible quality bar.

Report Standard

Report pages should preserve analysis quality while removing raw evidence that belongs in private case files. Public readers should be able to understand scope, method, impact, and remediation state without receiving unnecessary operational detail.

Templates in this section should help a reviewer decide whether a report is ready to become public. They should define required sections, evidence boundaries, and status language before a writer adds case-specific facts.

Reader Outcome

A complete page in this section should leave the reader with a clear next action, a clear limitation, and a clear route for follow-up. If the section is an index, it should explain what records will appear here, why they may be absent today, and which adjacent policy or template controls future entries. If it is a template, it should explain how to use the structure without treating the sample as a substitute for review.

Report templates should make private evidence boundaries visible before drafting begins. This reduces the chance that raw logs, credentials, or exploit-enabling detail are copied into public output.