private-vulnerability-report-template.md

Private Vulnerability Report Template

Use this template when filing a private report via:

• Security -> Report a vulnerability
• Draft repository security advisory

Copy/paste the sections below into the private report.

---

1) Summary

• Short title:
• Vulnerability class (for example: RCE, auth bypass, privilege escalation, SSRF, path traversal, secret exposure):
• Affected component(s):
• Suspected severity (S0 / S1 / S2 / S3):

Severity reference:

• Use SECURITY.md -> Severity Levels and SLA Matrix for assignment guidance.

2) Affected Scope

• Affected versions:
• Last known unaffected version:
• Deployment/runtime prerequisites:
• Feature flags or configuration conditions required:

3) Reproduction

• Environment:
  • OS:
  • Runtime/toolchain versions:
  • Config relevant to reproduction:
• Step-by-step reproduction: 1. 2. 3.
• Proof of concept payload/commands (safe/minimized):
• Expected behavior:
• Actual behavior:

4) Security Impact

• Impact on confidentiality:
• Impact on integrity:
• Impact on availability:
• Attack complexity and required privileges:
• Remote/local reachability:
• Estimated blast radius:

Optional CVSS estimate (if known):

• CVSS vector:
• CVSS score:

5) Mitigation and Fix Ideas

• Immediate mitigations/workarounds:
• Suggested patch direction:
• Backward compatibility concerns:

6) Disclosure Coordination

• Is coordinated disclosure requested? (yes/no)
• Earliest preferred disclosure date (if any):
• Credit preference/attribution:
• Contact channel for follow-up:

7) Attachments

• Logs (redacted):
• Stack traces (redacted):
• Screenshots/videos (if applicable):
• Patch/commit references (if already available):

8) Reporter Checklist

• I did not open a public issue for this unpatched vulnerability.
• I redacted secrets, tokens, and personal data.
• I provided reproducible steps and impact details.
• I included affected version/scope information.

---

Redaction Guidance

Before submission, remove or replace:

• API keys, tokens, credentials
• Internal hostnames, IPs, and private URLs
• User-identifying personal data
• Any exploit details that are unnecessary for maintainers to reproduce