How Triage Works

Organizations - Learn how H1 Triage can help your program

Updated over a week ago

Hackerone offers Triage Services as a paid offering that any customer can purchase along with their BBP or VDP. Triage Service customers benefit from the expertise of our in-house Triage Analysts, who provide a preliminary review of reports submitted by researchers to update the report’s metadata, suggest a severity and bounty, and leave a summary with steps to reproduce for faster remediation by the customer.

Triage Process

First Response

Inboxes menu

  • The report is submitted into the New inbox queue

  • H1 Triage leaves a comment for the hacker to let them know we are reviewing the report and assign it to themselves for investigation

    • First response times: 1 business day for Enterprise programs, 2 business days for Professional programs

  • The report moves from New to the H1 Triage queue

"Thank you for your submission" message

Needs More Information

Once a Triage Analyst has reviewed the report, they may conclude that they need more information from the customer or the hacker.

If an analyst needs more information from the hacker:

  1. Report status is changed to NMI (Needs more Info)

  2. Triage analyst leaves a public comment to open dialogue with the hacker

    1. There may be several public comment back & forth exchanges

  3. Once enough information is gathered, the triage analyst moves forward on the report to either close or validate the report

If an analyst needs more information from the organization's team

  1. Triage analyst leaves a public comment to let the hacker know they are reaching out to confer with the team

  2. The triage analyst assigns the report to the organization and leaves an internal-only comment for the organization's team to ask necessary questions

    1. There may be a several internal-only comment back & forth exchange

  3. Once enough information is gathered, the triage analyst moves forward on the report (reference Scenario 1 & 2 above)

Note: It’s best practice for the customer team to check their inbox daily as we have a 2 business day target for response to the H1 Triage team

Validate or Close

After review by the analyst and gathering additional information (if applicable), the analyst will either Close or Validate the report.

Valid

When a report is Validated or deemed eligible for a reward:

  1. The triage analyst will leave an internal-only Triage summary on the report including a summary of the issue, clear steps to reproduce, and an impact statement

  2. The triage analyst will suggest a severity based on CVSS and an award amount based on the bounty table in the program policy

  3. The report state is changed to Pending Program Review or Triaged depending on the program workflow

  4. The report is assigned to the program inbox queue for further action

Example of validated report email from Triage

Closed

If a report is deemed invalid and changed to a closed state, it can impact the hacker’s reputation. A closed report may be marked as:

  • Duplicate

  • Informative

  • N/A

  • Spam

See our Report States document for more information.

Close report and select status menu

Triage Ratings

Triage ratings allow HackerOne to measure performance, identify focus areas, and drive improvement. After each vulnerability report, hackers and customers can rate the overall report and triage experience from a scale of one through five, and even add comments for the HackerOne team.

Triage Ratings & Review

Did this answer your question?