> For the complete documentation index, see [llms.txt](https://docs.bountysecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bountysecurity.ai/creating-profiles/issue-properties.md).

# Issue properties

Write findings that explain the observation, evidence and practical impact.

Open the **Issue** tab in the profile editor. For an active profile, first select the step whose result you are describing.

| Editor control              | What to enter or select                                                            |
| --------------------------- | ---------------------------------------------------------------------------------- |
| Issue Name                  | A readable finding title describing the observation. Pro adds a BurpBounty prefix. |
| Severity                    | Information, Low, Medium or High, according to the evidence and impact.            |
| Confidence                  | Tentative, Firm or Certain.                                                        |
| Issue Detail                | What was observed, where and why it matters.                                       |
| Issue Background            | Context for the vulnerability or behavior.                                         |
| Remediation Detail          | Advice specific to the observation.                                                |
| Remediation Background      | General prevention guidance.                                                       |
| Don't show this issue alert | Check to suppress this profile/step's alert; leave unchecked to allow reporting.   |

{% hint style="info" %}
**Reporting checkbox**

Click **OK** to save these settings with the profile. Pro generates the corresponding JSON fields. In particular, the exported `showIssue` boolean follows the suppression checkbox: true suppresses reporting. You do not need to set that boolean manually.
{% endhint %}

`<payload>` and `<grep>` are issue-detail markers used by Pro's report formatting. Verify rendering on the intended engine and keep explanatory text understandable without substitution.

## Multi-step reporting

Check **Don't show this issue alert** on preparatory steps. Leave it unchecked on the confirmation step and fill in the issue text there. Review the issue metadata shown by Server's catalogue as well as the final reported issue when distributing a multi-step profile.

## Choose confidence conservatively

| Observation                      | Appropriate interpretation                                         |
| -------------------------------- | ------------------------------------------------------------------ |
| Marker reflected                 | Reflection observed, not confirmed JavaScript execution.           |
| Database error after a quote     | Injection indicator, stronger when a clean control lacks it.       |
| Slow response                    | Timing observation requiring controls and repeatability.           |
| Missing header                   | Configuration observation subject to protocol/application context. |
| Verified out-of-band interaction | Evidence of that interaction; assess what it proves about impact.  |

Findings retrieved from Server can be added to Burp's issues. Server summaries and evidence have separate retention periods; include owning server/scan/issue IDs in reports that need later retrieval.