Write the report before you finish the exploit

Habit that has made me measurably better: as soon as I am reasonably sure something is a bug, I open the report and write the summary. Before the full chain works.

Two things happen. First, writing down what I think is wrong usually shows me I cannot actually justify half of it yet, which sends me back with a better question. Second, when the exploit does land, the report is already most of the way written and I file it the same hour instead of the following weekend.

The reports I have sat on for a week are, without exception, the ones that came back as duplicates.