/services/bug-bounty-triage
ServiceBug bounty triage
Ongoing triage of everything sent to your bug bounty or vulnerability disclosure programme, by researchers who submit reports to programmes themselves. Nothing is rated or passed to your engineers until it has been reproduced. Duplicates and noise stop with us.
What we look for
- Whether the issue is real and still present, even when reproducing it takes two accounts, parallel requests or a forked chain
- Scope and eligibility under your own policy, not a generic exclusions list, with anything outside it closed by citing the clause that applies
- Duplicates of earlier reports, known issues and risks you have already accepted, judged on what is broken rather than on how a report describes it
- Severity from what the issue actually exposes in your environment, not raised to match the researcher's claim and not lowered to save a bounty
- Noise, from scanner output to unverified AI-generated reports, closed with a specific reason rather than a template
- Whether a fix closes the flaw, or only the exact request the researcher sent
- Coverage is every report the programme receives, read in full, because a badly written report is not the same as an invalid one
What you receive
- Critical issues escalated once confirmed, not held for the monthly report
- One ticket per root cause, with reproduction steps, evidence and a suggested fix
- Severity with the reasoning behind it, and a CVSS vector where you use one
- Researcher communication handled for you, disputes included
- Bounty recommendations against your own table, for you to approve and pay
- Each fix retested against the original report and its variants
- Monthly report and walkthrough call, covering what recurs and why
Get a fixed price for bug bounty triage.
A 30 minute scoping call, then a fixed price. No discovery questionnaire, no pressure to buy.