Write a security finding for a penetration test report
Turns your notes on a vulnerability into a clear, professional finding with risk rating, evidence, impact, and fix steps.
The prompt
Write a security finding for a penetration test or security assessment report.
Vulnerability title: [e.g. "Stored cross-site scripting in comment field"]
Affected asset: [URL, endpoint, host, app version - anonymize if needed]
What I found and how: [my notes: steps to reproduce, requests and responses, screenshots described]
Impact I could demonstrate: [what an attacker could actually do]
Rating method: [e.g. CVSS v3.1 / v4.0, or our internal high/medium/low scale]
Report audience: [technical team / executives / both]
Write the finding with these sections:
1. Title
2. Summary: one or two sentences a non-technical reader can follow.
3. Severity and rating: proposed rating with the vector or reasoning, plus likelihood and impact in my environment. Mark the score [CONFIRM] for me to validate.
4. Description: what the weakness is and why it exists.
5. Evidence and steps to reproduce: numbered, precise, based only on my notes. Do not invent requests, payloads, or output; mark gaps [ADD EVIDENCE].
6. Business impact: realistic consequences, without exaggeration.
7. Recommendations: the root-cause fix first, then short-term mitigations, with how to verify the fix.
8. References: relevant categories such as the CWE or OWASP entry, named generically if you're not sure of the exact ID [CONFIRM].
Use precise, neutral language: no blame, no hype. Remove any credentials, tokens, or customer personal data from the evidence and note that it was redacted.
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Software Development prompts
What to fill in
- e.g. "Stored cross-site scripting in comment field"
- URL, endpoint, host, app version - anonymize if needed
- what an attacker could actually do
- e.g. CVSS v3.1 / v4.0, or our internal high/medium/low scale
- technical team / executives / both
- CONFIRM
- ADD EVIDENCE
How this prompt is built
This prompt follows the Few-Shot structure (Few-shot prompting). A few-shot prompt includes one or more worked examples of the input and the output you want, so the model can copy the pattern instead of guessing it.
Related prompts
- Write or review a network switch configuration changeA vendor-aware switch config for your requirement, plus a pre-change review, rollback steps, and verification commands.
- Vet an open-source library before adding itEvaluates a dependency for maintenance health, security, license fit, and lock-in so you can decide whether to adopt it.
- Make background jobs and webhooks safe to retryDesigns idempotency, retries, and dead-letter handling so jobs, queue consumers, and webhooks never double-charge or lose work.
- Write an incident postmortem and runbookA blameless postmortem with timeline, root cause, actions, and a runbook update.