<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-bug-bounty-triage
description: >-
  Implement bug bounty submission triage workflows including severity validation,
  duplicate detection, researcher communication, reward calculation, and
  integration with vulnerability management pipelines.
domain: cybersecurity
subdomain: vulnerability-management
tags:
  - bug-bounty
  - vulnerability-disclosure
  - triage
  - hackerone
  - bugcrowd
  - vdp
  - researcher-management
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Implementing Bug Bounty Triage

## Overview

Bug bounty programs extend your security testing through external researchers, but
the value depends on triage quality. Poor triage burns researcher trust and misses
real vulnerabilities. This skill covers structured triage workflows, severity
validation, duplicate detection, reward calculation, and integration with internal
vulnerability management using HackerOne and Bugcrowd APIs.

Mode: `[MODE: BLUE]` — Defensive vulnerability intake and management.

## Prerequisites

- HackerOne or Bugcrowd program access with API credentials
- Vulnerability management platform for internal tracking
- Python 3.10+ with `requests`
- Defined scope, severity, and reward tables

## Key Concepts

### Triage Workflow

```
Submission received
├── Auto-acknowledge (within 1 business day)
├── Scope validation — is target in scope?
│   ├── Out of scope → Inform researcher, close as N/A
│   └── In scope → continue
├── Duplicate check — has this been reported before?
│   ├── Duplicate → Credit original reporter, close
│   └── New → continue
├── Severity validation — reproduce and verify
│   ├── Not reproducible → Request more info, hold 7 days
│   ├── False positive → Explain reasoning, close
│   └── Valid → Assign severity, calculate reward
├── Internal tracking — create Jira/ServiceNow ticket
├── Remediation — standard VM pipeline
├── Researcher notification — fix deployed, bounty awarded
└── Disclosure — coordinate public disclosure timeline
```

### Reward Table

| Severity | CVSS Range | Reward Range | Response SLA |
|----------|-----------|-------------|--------------|
| Critical | 9.0–10.0 | $5,000–$25,000 | 1 business day |
| High | 7.0–8.9 | $2,000–$5,000 | 3 business days |
| Medium | 4.0–6.9 | $500–$2,000 | 5 business days |
| Low | 0.1–3.9 | $100–$500 | 10 business days |

### HackerOne API Integration

```bash
# List reports (triaged, new)
curl -s "https://api.hackerone.com/v1/reports" \
  -u "$H1_API_ID:$H1_API_KEY" \
  -G --data-urlencode 'filter[program][]=$PROGRAM' \
  --data-urlencode 'filter[state][]=new' | jq '.data[]'

# Get report details
curl -s "https://api.hackerone.com/v1/reports/REPORT_ID" \
  -u "$H1_API_ID:$H1_API_KEY" | \
  jq '{title: .data.attributes.title, severity: .data.attributes.severity_rating, state: .data.attributes.state}'

# Change report state to triaged
curl -s -X POST "https://api.hackerone.com/v1/reports/REPORT_ID/state_changes" \
  -u "$H1_API_ID:$H1_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"data": {"type": "state-change", "attributes": {"state": "triaged", "message": "Confirmed and assigned to engineering."}}}'

# Award bounty
curl -s -X POST "https://api.hackerone.com/v1/reports/REPORT_ID/bounties" \
  -u "$H1_API_ID:$H1_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"data": {"attributes": {"amount": 5000, "bonus_amount": 0, "message": "Thank you for the report!"}}}'
```

### Bugcrowd API Integration

```bash
# List submissions
curl -s "https://api.bugcrowd.com/submissions" \
  -H "Authorization: Token $BC_TOKEN" \
  -H "Accept: application/vnd.bugcrowd+json" | jq '.data[]'

# Update submission state
curl -s -X PATCH "https://api.bugcrowd.com/submissions/SUBMISSION_UUID" \
  -H "Authorization: Token $BC_TOKEN" \
  -H "Content-Type: application/vnd.bugcrowd+json" \
  -d '{"data": {"type": "submission", "attributes": {"state": "triaged"}}}'
```

## Workflow

### Step 1: Fetch New Submissions

```bash
node scripts/agent.js --action fetch \
  --platform hackerone \
  --output /tmp/new_submissions.json
```

### Step 2: Triage Submissions

```bash
node scripts/agent.js --action triage \
  --input /tmp/new_submissions.json \
  --output /tmp/triage_results.json
```

### Step 3: Calculate Rewards

```bash
node scripts/agent.js --action reward \
  --input /tmp/triage_results.json \
  --output /tmp/reward_calculations.json
```

## Verification

- [ ] Auto-acknowledgment within 1 business day of submission
- [ ] Duplicate detection checked against last 12 months of reports
- [ ] Severity validated through independent reproduction
- [ ] Rewards calculated consistently using published table
- [ ] Internal vulnerability tickets created for all valid submissions
- [ ] Researcher communication SLAs tracked and met
- [ ] Quarterly program metrics published (submissions, payouts, MTTR)

## References

- [HackerOne API Documentation](https://api.hackerone.com/customer-resources/)
- [Bugcrowd API Documentation](https://docs.bugcrowd.com/api/)
- [ISO 29147 — Vulnerability Disclosure](https://www.iso.org/standard/72311.html)
- [FIRST CVSS Calculator](https://www.first.org/cvss/calculator/4.0)
