When a hacker reports a vulnerability that has already been reported, it's considered a duplicate report. When you mark a report as a duplicate, you can choose between these two options:
Option | Details |
1 | Add the second hacker as an external participant on the original report. |
2 | Don't add the hacker as an external participant on the original report. |
Adding a Hacker to the Original Report
To add the hacker to the original report:
Go to the bottom of the report above the comment box.
Change the action picker to Close report > Duplicate.
Enter the original report number in the Search report field and select the report from the selection list.
A checkbox stating Add hacker name to the original report will show under the Search report field.
Select the checkbox to add them to the report.
Data Visibility on Duplicate Reports
When you mark a report as a duplicate, the information shared with the hacker depends on whether you add them as a participant to the original report.
If You Do Not Add the Hacker to the Original Report
When you close the report as a duplicate and do not select Add hacker name to the original report, the hacker does not gain access to the original report.
What They Can See
On their duplicate report, the hacker can see:
The report status updated to Duplicate
A reference to the original report ID
Limited metadata about the original report, including:
Report ID with a link
Report state (for example, Triaged or Resolved)
Report title (or “Redacted” for reports before Feb 2025)
Submission date
Severity and score
What They Cannot See
The hacker does not have access to:
Full report description
Comments or activity on the original report
Attachments
Other participants
Internal discussions
This option limits visibility to high-level metadata only.
If You Add the Hacker to the Original Report
When you select Add hacker name to the original report, they are added as an external participant on the original report.
What Changes
The hacker becomes a participant on the original report
An activity entry notes that they submitted a duplicate and were added to the report
They gain the same visibility as other external participants
What They Can See
The hacker can now access the full original report, including:
Full report description
All comments and activity
Attachments
Other participants and collaborators
Report timeline and updates
Award information, if visible
Warning: Review Sensitive Information Before Adding a Participant
Adding a hacker to the original report gives them full access to its contents. We advise reviewing the report before adding participants to ensure:
Sensitive data is removed or redacted
Internal-only discussions are not exposed
Attachments do not contain confidential information
Once added, they can immediately view all existing content on the report.
Program Setting
The ability to add a participant to the original report depends on your program configuration. To enable this feature, please contact your Customer Success Manager.