## Writing the Report

 Developers hate generic reports.
"Fix Cross Site Scripting" - HOW? WHERE?

### The Perfect Bug Report
1.  **Title**: Reflected XSS on Search Page.
2.  **Location**: `GET /search.php?q=PAYLOAD`
3.  **Evidence**: Screenshot of the `alert(1)` box.
4.  **Impact**: "Attacker can steal session cookies."
5.  **Fix**: "Sanitize input using `htmlspecialchars()` function in PHP."