Bug Report Template for Cybersecurity Products
Bug reports in cybersecurity products require additional rigor: vulnerability classification (CVSS scoring), CVE tracking, and the distinction between functional bugs and security vulnerabilities. A security bug may also be a reportable vulnerability.
This template separates functional bugs from security vulnerabilities and includes the additional fields needed for responsible disclosure and vulnerability management.
Template sections
5 sections covering the complete bug report workflow.
Bug vs. Vulnerability Classification
Determine if the bug is a functional defect or a security vulnerability. Functional bugs affect user experience. Security vulnerabilities affect the confidentiality, integrity, or availability of systems or data. Vulnerabilities follow a different workflow: private disclosure, CVSS scoring, and coordinated remediation.
CVSS Scoring
For security vulnerabilities, calculate the CVSS v3.1 score. Document attack vector (Network/Adjacent/Local/Physical), attack complexity (Low/High), privileges required (None/Low/High), user interaction (None/Required), and impact on confidentiality, integrity, and availability. The CVSS score determines remediation priority.
CVE Tracking
If the vulnerability is in a dependency, reference the CVE ID. If the vulnerability is in your product and meets disclosure thresholds, coordinate with your security team on whether to request a CVE. Track affected product versions and the fix version.
Remediation Requirements
Document the remediation: patch, workaround, or configuration change. Specify the disclosure timeline if customer notification is required. For critical vulnerabilities, include the hotfix deployment plan and customer communication template.
Regression Testing
Security bugs require expanded regression testing: run the full security test suite (OWASP ZAP, Burp Suite), verify the fix does not introduce new attack surfaces, and confirm the vulnerability cannot be exploited through alternative paths.
Copy-paste template
## Bug / Vulnerability Report ### Classification - Type: [Functional Bug / Security Vulnerability] - CVE: [CVE-YYYY-NNNNN or N/A] ### Summary [Description of the issue] ### CVSS v3.1 (if vulnerability) - Score: [0.0-10.0] - Vector: AV:[N/A/L/P]/AC:[L/H]/PR:[N/L/H]/UI:[N/R] - Severity: [Critical/High/Medium/Low] ### Steps to Reproduce 1. [Step 1] 2. [Step 2] ### Impact - Confidentiality: [High/Low/None] - Integrity: [High/Low/None] - Availability: [High/Low/None] ### Remediation - Fix: [Patch / Workaround / Config change] - Affected versions: [List] - Fix version: [Version] - Disclosure timeline: [Date if applicable]
Frequently asked questions
Generate instead of filling in templates
Connect your tools, and Vantage generates the content using real product data. Free to start.
Free to start. No credit card required.