All reports are either Open or Closed and can be changed to a variety of different states.
Open Report States
When reports haven't been acted on or resolved, they are in an open state. These are the Open report states:
The report is in an unread state.
Pending Program Review
(Currently in beta) The report has been reviewed by HackerOne triage and is now pending review from the program. This only shows for programs that use HackerOne's triage services.
The report is evaluated but hasn't been resolved. It is in the state of being fixed.
The vulnerability is in the process of being retested.
Needs More Info
More information is needed from the hacker about the vulnerability. Reports in the Needs More Info state for more than 30 days will automatically close and won't hurt the hacker's reputation.
There are impacts to hacker reputation when the program changes the report state. Reputation isn't impacted when the hacker changes the report state themselves. They can self-close a report until it's marked as triaged.
Closed Report States
When a report is complete, and no further dialogue with the team, triager, or hacker is needed, it's changed into a closed state. Closed states change a hacker's reputation.
These are the Closed report states:
Change to Hacker Reputation
The report is valid and no further dialogue with the hacker is needed.
The report contains useful information but doesn't warrant immediate action or a fix. Examples of informative reports include:
A program can consider providing an alternative risk assessment or other mitigating factors. Public disclosure is available with mutual agreement.
This issue has already been reported. Programs can build trust by attributing the issue to its original discoverer and linking it to a previous report or including other details about its discovery. Public disclosure isn't available for this state.
If the hacker submits the original report:
The report doesn't contain a valid issue and has no security implications. Security teams should describe why the report was invalid, so the hacker can improve their hacking skills.
The report is invalid because a legitimate security vulnerability isn't described. The report may be incomprehensible, abusive, and/or exhibit harassment. Reports that sell any sort of product or service will also be marked as Spam.