Write professional pentest and bug bounty reports in minutes — CVSS scoring, AI-drafted findings, and one-click export to PDF or Markdown. PoCcraft is the pentest reporting tool built for solo testers and bug bounty hunters who need consistent findings, OWASP-aligned structure, and remediation sections without the formatting grind.
Free core tool · CVSS 3.1 & 4.0 · Bug bounty & pentest modes · generate.poccraft.com
You already did the hard part — finding the bug. PoCcraft handles the report structure, severity scoring, and formatting so you can submit faster with fewer rewrites.
Drop in your reproduction steps, HTTP request, or exploit snippet. PoCcraft builds the report around what you actually found.
Use the built-in CVSS calculator, pick from 15+ vulnerability templates, and generate description and impact from your PoC with one click.
Switch between bug bounty and pentest output modes, review the live preview, then export Markdown, plain text, or a polished PDF.
CVSS scoring, templates, AI assist, and export — without switching tools.
Full CVSS 3.1 and 4.0 calculator — base score and vector update live as you write the finding.
Generate description, impact, and remediation from your PoC. You review and edit everything before export.
Concise submissions for HackerOne and Bugcrowd, or fuller sections for client pentest deliverables.
One-click export to Markdown, plain text, or formatted PDF — ready for triagers or clients.
XSS, SQLi, IDOR, SSRF, and more — pre-structured fields you adapt to each finding.
Optional sign-in stores reports with AES-256-GCM encryption at rest — unique salt and key derivation per record. How we protect your data
Every cloud-saved report is encrypted with AES-256-GCM before it touches our database. If our database were ever exposed, your findings wouldn't be.
You save a report — encrypted server-side with AES-256-GCM before it's written to disk.
Each report gets its own random salt and IV, so no two records share exposure.
Data is only decrypted when you request it, over an authenticated session.
Pentest and bug bounty reports aren't generic notes — they're exploit details, client scope, and proof-of-concept steps. We encrypt cloud saves because a database breach shouldn't mean your findings leak in plaintext.
No account required for the core tool. Drafts stay in your browser until you choose to save to the cloud. When you do, we tell you exactly what encryption covers — and what it doesn't.
Read our honest limitationsDownload editable templates or generate them live — pentest, vulnerability assessment, security assessment, and bug bounty formats.