Hackerone offers Hai Triage Services as a paid offering that any customer can purchase along with their BBP or VDP. Hai Triage customers benefit from the expertise of our in-house triage analysts, who provide a preliminary review of reports submitted by researchers to update the report’s metadata, suggest a severity and bounty, and leave a summary with steps to reproduce for faster remediation by the customer.
Hai Triage Process
First Response
The report is submitted to the New inbox queue.
H1 Intake performs preliminary checks on the report. If any of the checks fail, the report is closed with an appropriate response to the researcher.
If the report passes all checks, H1 Intake leaves a comment for the researcher to acknowledge receipt and inform them that the report has been forwarded for detailed validation.
24 hours for Enterprise programs (weekends excluded)
48 hours for Professional programs (weekends excluded)
Hai Triage Plus programs are excluded from H1 Intake. 12 hours SLA for High priority, 24 hours SLA for Regular priority, + weekend support
The Hai Triage Validation team then performs an in-depth investigation and validation of the report.
Needs More Information
Once a Hai Triage Analyst has reviewed the report, they may conclude that they need more information from the customer or the hacker.
If an analyst needs more information from the hacker:
Report status is changed to NMI (Needs more Info)
The analyst leaves a public comment to open dialogue with the hacker
There may be several public comment back & forth exchanges
Once enough information is gathered, the analyst moves forward on the report to either close or validate the report
If an analyst needs more information from the organization's team
The H1 analyst leaves a public comment to let the hacker know they are reaching out to confer with the team
The H1 analyst assigns the report to the organization and leaves an internal-only comment for the organization's team to ask necessary questions
There may be a several internal-only comment back & forth exchange
Once enough information is gathered, the Hai Triage analyst moves forward on the report (reference Scenario 1 & 2 above)
Note: It’s best practice for the customer team to check their inbox daily as we have a 2 business day target for response to the Hai Triage team
Validate or Close
After review by the analyst and gathering additional information (if applicable), the analyst will either close or validate the report.
Valid
When a report is validated or deemed eligible for a reward:
The Hai Triage analyst will leave an internal-only Hai Triage summary on the report, including a summary of the issue, clear steps to reproduce, and an impact statement.
The analyst will suggest a severity based on CVSS and an award amount based on the bounty table in the program guidelines.
The report state is changed to Pending Program Review or Triaged depending on the program workflow.
The report is assigned to the program inbox queue for further action.
Closed
If a report is deemed invalid and changed to a closed state, it can impact the hacker’s reputation. A closed report may be marked as:
Duplicate
Informative
N/A
Spam
See our Report States document for more information.
Hai Triage Ratings
Hai Triage ratings allow HackerOne to measure performance, identify focus areas, and drive improvement. After each vulnerability report, hackers and customers can rate the overall report and experience on a scale of one through five, and even add comments for the HackerOne team.
