I've spent 5 years in QA — 3 of them at Japan's largest software testing firm, managing test teams for major game publishers, and now as a QA director. In that time I've read thousands of bug reports.
Maybe 10% of them were actually useful on first read.
The other 90% triggered the same ritual: a developer reads the report, can't reproduce it, writes "works on my machine", and the bug ping-pongs between QA and dev for three days. The bug didn't cost three days. The report did.
Here's the template I enforce on every team I run, and the reasoning behind each field.
The template
## Title
[Area] One-line summary: what breaks, under which condition
## Environment
Device / OS / Browser + version / App build or commit
Account type used (if relevant)
## Steps to Reproduce
1. Numbered.
2. Exact.
3. From a clean state.
## Expected
What should happen (and WHY you believe that — spec link, design, or convention)
## Actual
What happens instead. Paste exact error text, never paraphrase it.
## Reproduction rate
n / m attempts (e.g. 4/5). "Sometimes" is not a number.
## Severity + why
High / Medium / Low — with one sentence of business impact.
## Evidence
Screenshot (annotated), screen recording, console/network log.
Nothing exotic. The value is in the details most reports skip.
The three fields everyone gets wrong
1. Reproduction rate: "sometimes" is not a number
"It sometimes fails" tells a developer nothing. "4/5 attempts with network throttled to Slow 3G, 2/5 on fast connection" tells them it's a race condition — before they've opened the code.
When I find a flaky-looking bug, I run it five more times and count. Those 10 minutes routinely save the developer half a day of guessing. The repro-rate line is the single highest-ROI sentence in the entire report.
2. Expected behavior needs a "because"
Weak: "Expected: works correctly."
Strong: "Expected: the second click is ignored, because the button should disable on first submission (and a double POST here means a double charge on checkout)."
The "because" does two jobs: it tells the developer where the bar is, and it tells the triage meeting why the bug matters. Severity debates usually die the moment the expected behavior has a reason attached.
3. Severity is a business statement, not a feeling
My rule of thumb:
- High: blocks a core flow, loses data, or costs money (double charges, lost form submissions, broken checkout)
- Medium: core flow survives, but a real user segment is hurt (an error message screen readers never announce, a layout broken on one device class)
- Low: cosmetic, or an edge case with an easy workaround
Note that who is affected changes severity. A broken layout at 717px sounds Low — until you know 717px is exactly the half-open posture of foldable phones, a growing share of premium Android devices. (I test on a Motorola Razr for precisely this reason. The number of bugs living between Tailwind's sm and md breakpoints is remarkable.)
What "no bugs found" should look like
The most undervalued deliverable in QA: the honest empty report.
If I test a flow and find nothing critical, the client still gets a list of what was tested, how, on which devices, and what looks solid — plus any usability observations that aren't bugs. "We checked and it's fine" is informational. "We checked X, Y, Z in these 4 environments and found nothing" is evidence.
Teams that only reward found-bug counts end up with inflated Low-severity noise and no idea what's actually been covered. Coverage transparency beats bug-count theater.
A 30-second checklist before you hit send
- [ ] Could a developer reproduce this without asking me anything?
- [ ] Is the repro rate a number?
- [ ] Does "Expected" contain a because?
- [ ] Does severity state the business impact?
- [ ] Is there at least one piece of visual evidence?
If all five are checked, your bug report is already in the top 10%.
I'm a QA director in Japan (ex-SHIFT, Japan's largest QA firm) and I offer manual QA & bug hunting as a freelance service — exploratory testing on real devices (Windows 11 / iPhone / foldable Android) with reports exactly like the template above. You can find me on Fiverr or at s-nagaya.vercel.app. My E2E automation work is over here: AI-driven test automation with Claude Code + Playwright.
Top comments (0)