We've seen reports from other vendors. Most are 40-page PDFs that list CVE numbers and call it done. Your developer reads page one and closes it.
Here's what a report should contain:
#01. EXECUTIVE SUMMARY (1 page)
Written for a non-technical business owner.
What we tested
What we found
What the business risk is
What needs to happen next
No jargon. No CVE numbers. Just: here's your risk level and here's what to do about it.
#02. FINDING BREAKDOWN
Each finding must include:
TITLE: Stored XSS in comment field SEVERITY: High LOCATION: https://yoursite.com/blog/comment PROOF: Screenshot + HTTP request that triggered it IMPACT: Attacker can steal session cookies of any user FIX: Sanitize input with htmlspecialchars() on output VERIFICATION: How to confirm it's fixed
If a report doesn't include proof and a specific fix, it's not a report. It's a guess.
#03. SEVERITY RATINGS — WHAT THEY MEAN
Critical — fix today. Data loss or full system compromise is possible right now.
High — fix this week. Significant data exposure or account takeover possible.
Medium — fix this month. Requires specific conditions to exploit but real risk.
Low — fix in next release. Minor information disclosure or best-practice violation.
Info — awareness only. No immediate action needed.
#04. REMEDIATION GUIDANCE
Not "patch your dependencies." Specific guidance:
BAD: "Update WordPress plugins" GOOD: "Update WooCommerce from 7.1.0 to 8.4.0. CVE-2023-47777 allows unauthenticated order manipulation. Update via WP Admin > Plugins."
Every finding needs a fix your developer can implement without Googling what you meant.
#05. RETEST CONFIRMATION
After you fix the findings, we retest each one. You get written confirmation that the vulnerability is closed — not just your developer's word.
#WHAT WE DELIVER
Every SecureNep report follows this structure. PDF + raw findings export. Delivered within 48 hours of engagement completion.