Hackerone offers Triage Services as a paid offering that any customer can purchase along with their BBP or VDP. Triage Service customers benefit from the expertise of our in-house Triage Analysts, who provide a preliminary review of reports submitted by researchers to update the report’s metadata, suggest a severity and bounty, and leave a summary with steps to reproduce for faster remediation by the customer.
Triage Process
First Response
The report is submitted into the New inbox queue
H1 Triage leaves a comment for the hacker to let them know we are reviewing the report and assign it to themselves for investigation
First response times: 1 business day for Enterprise programs, 2 business days for Professional programs
The report moves from New to the H1 Triage queue
Needs More Information
Once a Triage Analyst has reviewed the report, they may conclude that they need more information from the customer or the hacker.
If an analyst needs more information from the hacker:
Report status is changed to NMI (Needs more Info)
Triage analyst leaves a public comment to open dialogue with the hacker
There may be several public comment back & forth exchanges
Once enough information is gathered, the triage analyst moves forward on the report to either close or validate the report
If an analyst needs more information from the organization's team
Triage analyst leaves a public comment to let the hacker know they are reaching out to confer with the team
The triage analyst assigns the report to the organization and leaves an internal-only comment for the organization's team to ask necessary questions
There may be a several internal-only comment back & forth exchange
Once enough information is gathered, the triage analyst moves forward on the report (reference Scenario 1 & 2 above)
Note: It’s best practice for the customer team to check their inbox daily as we have a 2 business day target for response to the H1 Triage team
Validate or Close
After review by the analyst and gathering additional information (if applicable), the analyst will either Close or Validate the report.
Valid
When a report is Validated or deemed eligible for a reward:
The triage analyst will leave an internal-only Triage summary on the report including a summary of the issue, clear steps to reproduce, and an impact statement
The triage analyst will suggest a severity based on CVSS and an award amount based on the bounty table in the program policy
The report state is changed to Pending Program Review or Triaged depending on the program workflow
The report is assigned to the program inbox queue for further action
Closed
If a report is deemed invalid and changed to a closed state, it can impact the hacker’s reputation. A closed report may be marked as:
Duplicate
Informative
N/A
Spam
See our Report States document for more information.
Triage Ratings
Triage ratings allow HackerOne to measure performance, identify focus areas, and drive improvement. After each vulnerability report, hackers and customers can rate the overall report and triage experience from a scale of one through five, and even add comments for the HackerOne team.
