security-report

Security Report

Applicable Scenarios

• Security review summary report
• Vulnerability summary report
• Compliance audit report
• Remediation tracking report

Core Principles

1. 报告给决策者看
   首页有结论 + 风险等级

2. 每个漏洞有修复建议
   不只报问题

1. Risk grading (CVSS) Critical / High / Medium / Low

2. Remediation must be verified Fixed does not mean actually fixed

3. Do not leak the report The security report itself is sensitive information

## 报告结构

```markdown
# 安全评审报告

## 摘要
- 评审范围：[系统/模块]
- 评审日期：
- 发现总数：X 个
- 风险分布：Critical X / High X / Medium X / Low X
- 结论：[可上线 / 需修复后上线 / 不可上线]

## 发现汇总
| # | 标题 | 严重度 | 状态 | 修复人 |
|---|------|--------|------|--------|
| 1 | IDOR 越权 | High | 已修复 | Dev |
| 2 | XSS 反射 | Medium | 待修复 | Dev |

## 详细发现
[每个漏洞用 vulnerability-report-template]

## 修复跟踪
| # | 漏洞 | 修复方案 | 截止 | 验证 |
|---|------|---------|------|------|
| 1 | IDOR | 加资源归属校验 | 本周 | ✅ |

## 建议
1. [系统级建议]
2. [流程级建议]

CVSS Score Quick Reference

Score	Level	Meaning
9.0~10.0	Critical	Remote unauthenticated exploitation / data loss
7.0~8.9	High	Post-authentication exploitation / partial data
4.0~6.9	Medium	Requires specific conditions
0.1~3.9	Low	Information disclosure / edge case

Supporting Templates

• templates/security-report-template.md — Complete security report template

Quality Self-Check

□ 摘要有结论
□ 风险分级（CVSS）
□ 每个发现有复现步骤
□ 每个发现有修复建议
□ 修复已验证
□ 报告不泄露
□ 给 PM 可读版本

Common Pitfalls

1. Only listing vulnerabilities without giving a conclusion——Decision-makers do not know whether it can go live
2. No grading——All vulnerabilities look equally severe
3. Not verifying remediation——Assuming it is fixed when it is actually not fixed
4. Report is too technical——PM cannot understand it
5. Report leakage——Secondary risk

Collaboration with other skills

上游：
  所有其他 security skills → 发现汇总

下游：
  project-manager → 风险决策
  backend/frontend → 修复
  technical-writer → 安全文档