PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Setting the Bar High for Bug Bounty Triage and Validation

bugcrowd.com | vulnerability | #bug-bounty | #vulnerability-management | #bugcrowd | #triage | #validation | #sla
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bugcrowd outlines its triage standards: every submission gets engineer review, critical issues are answered within a 24-hour SLA, and managed programs delivered 94.76% valid signal in 2017.
Published
Collected

Related coverage

vulnerability · bugcrowd.com
Bugcrowd Announces the Availability of Self-Service Vulnerability Disclosure Programs
Bugcrowd launches self-service Vulnerability Disclosure Programs: a structured intake and triage pipeline for bug reports, with managed triage for the first 15 or 75 submissions.
research · bishopfox.com
Separating Signal from Slop: Triaging CVEs in the Age of AI Security Research
CVE disclosures are up 85% while exploitation barely moved. Bishop Fox breaks down four Nginx CVEs that looked critical but rarely affect real deployments.
vulnerability · yeswehack.com
‘Happy hunters equal happy customers and vice versa’: YesWeHack vulnerability triage chief Adrien Jeanneau on creating a virtuous Bug Bounty circle
Interview with Adrien Jeanneau, head of YesWeHack's triage team: how clear, actionable reports build customer confidence, the seven-step triage process, and 24/7 operations.
vulnerability · yeswehack.com
9 rules for a successful first-time Bug Bounty Program
Nine rules for a successful first Bug Bounty program: clear team roles, a dedicated manager, a detailed brief, efficient triage, transparent payments and integration with internal remediation.
vulnerability · hackerone.com
Advanced Workflows with Inbox Views
HackerOne adds customizable Inbox Views: security teams can create, reorder and remove saved filters to build advanced disclosure workflows, such as Tier 1/Tier 2 triage, per-platform queues or separate bounty stages.
vulnerability · hackerone.com
Edit a Report's Vulnerability Types
HackerOne adds the ability for security teams to edit a report's vulnerability types after submission, with every change recorded in the report timeline for more accurate vulnerability data.
Back