PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Bug Bounty or Bust! The Art of Triage

hackerone.com | vulnerability | #bug-bounty | #rce | #triage | #best-practices | #workflow | #hackerone | #guide
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Triager's guide: run weekly on-call rotations to share the report load, triage new reports by severity and reputation first, watch SLA clocks on older reports, and drive bounty decisions.
Published
Collected

Related coverage

vulnerability · hackerone.com
Advanced Workflows with Inbox Views
HackerOne adds customizable Inbox Views: security teams can create, reorder and remove saved filters to build advanced disclosure workflows, such as Tier 1/Tier 2 triage, per-platform queues or separate bounty stages.
vulnerability · yeswehack.com
9 rules for a successful first-time Bug Bounty Program
Nine rules for a successful first Bug Bounty program: clear team roles, a dedicated manager, a detailed brief, efficient triage, transparent payments and integration with internal remediation.
vulnerability · vercel.com
Our $1 million hacker challenge for React2Shell
We paid $1M to security researchers to break our WAF. Here's what we learned defending against React2Shell.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
vulnerability · hackerone.com
AlienVault streamlines their vulnerability disclosure with HackerOne Response
AlienVault sheds spreadsheet-based vuln handling for HackerOne Response: triaged reports auto-create tickets and response time drops from five days to one or two, says Andrew Lowe.
vulnerability · hackerone.com
HackerOne and JIRA integration update: more improvements, fewer clicks
HackerOne's JIRA integration gets three updates: the connector is now live on the Atlassian Marketplace, JIRA issues can be created in one click from a report, and two-way syncing is customizable per workflow.
Back