Hackerone offers Triage Services as a paid offering that any customer can purchase along with their BBP or VDP. Triage Service customers benefit from the expertise of our in-house Triage Analysts, who provide a preliminary review of reports submitted by researchers to update the report’s metadata, suggest a severity and bounty, and leave a summary with steps to reproduce for faster remediation by the customer.
Triage Process
First Response
The report is submitted to the New inbox queue.
H1 Intake performs preliminary checks on the report. If any of the checks fail, the report is closed with an appropriate response to the researcher.
If the report passes all checks, H1 Intake leaves a comment for the researcher to acknowledge receipt and inform them that the report has been forwarded for detailed validation.
24 hours for Enterprise programs (weekends excluded)
48 hours for Professional programs (weekends excluded)
Triage Plus programs are excluded from H1 Intake. 12 hours SLA for High priority, 24 hours SLA for Regular priority, + weekend support
The Triage Validation team then performs an in-depth investigation and validation of the report.
Needs More Information
Once a Triage Analyst has reviewed the report, they may conclude that they need more information from the customer or the hacker.
If an analyst needs more information from the hacker:
Report status is changed to NMI (Needs more Info)
Triage analyst leaves a public comment to open dialogue with the hacker
There may be several public comment back & forth exchanges
Once enough information is gathered, the triage analyst moves forward on the report to either close or validate the report
If an analyst needs more information from the organization's team
Triage analyst leaves a public comment to let the hacker know they are reaching out to confer with the team
The triage analyst assigns the report to the organization and leaves an internal-only comment for the organization's team to ask necessary questions
There may be a several internal-only comment back & forth exchange
Once enough information is gathered, the triage analyst moves forward on the report (reference Scenario 1 & 2 above)
Note: It’s best practice for the customer team to check their inbox daily as we have a 2 business day target for response to the H1 Triage team
Validate or Close
After review by the analyst and gathering additional information (if applicable), the analyst will either Close or Validate the report.
Valid
When a report is Validated or deemed eligible for a reward:
The triage analyst will leave an internal-only Triage summary on the report including a summary of the issue, clear steps to reproduce, and an impact statement
The triage analyst will suggest a severity based on CVSS and an award amount based on the bounty table in the program policy
The report state is changed to Pending Program Review or Triaged depending on the program workflow
The report is assigned to the program inbox queue for further action
Closed
If a report is deemed invalid and changed to a closed state, it can impact the hacker’s reputation. A closed report may be marked as:
Duplicate
Informative
N/A
Spam
See our Report States document for more information.
Triage Ratings
Triage ratings allow HackerOne to measure performance, identify focus areas, and drive improvement. After each vulnerability report, hackers and customers can rate the overall report and triage experience from a scale of one through five, and even add comments for the HackerOne team.
