Skip to content
TRIAGERS™
Methodology

How we triage.

This is the exact process every report in your queue goes through: the same discipline whether it's a launch-day flood or a quiet Tuesday.

  1. 01

    Intake & screening

    Every report

    A human reads every submission. No auto-close rules decide what deserves attention. We screen against your scope and policy, flag obvious noise patterns (scanner exports, out-of-scope assets, AI-generated slop), and pull anything time-critical to the front of the queue.

  2. 02

    Reproduction

    Reproduce-first

    Claimed impact gets reproduced in a controlled environment, exactly as described, then pushed further. Does the IDOR enumerate? Does the XSS fire in a real victim context? If we can't reproduce, we ask the researcher precise questions instead of bouncing the report with a form letter.

  3. 03

    Duplicate matching

    Root cause

    Candidates are checked against your program history using root-cause matching: if one fix resolves both reports, it's a duplicate, regardless of which endpoint it arrived on. Verdicts cite the original report so researchers can see the match is real.

  4. 04

    Severity assessment

    Impact-based

    Severity is proposed from demonstrated impact in your context (who can exploit it, from where, at what scale, against what data), with written reasoning. We align to CVSS or your platform taxonomy and flag exactly what would move the rating up or down.

  5. 05

    Researcher communication

    Your voice

    Fast first responses, specific verdicts, and severity arguments made on evidence. We can respond in-queue under your program's voice or draft for your team to send. Either way, researchers are treated like the allies they are.

  6. 06

    Enriched handoff

    Ready to fix

    Valid findings arrive ready to action: confirmed reproduction steps, a working PoC, proposed severity with reasoning, and remediation advice. On the Pro plan, messy reports are fully rewritten before they reach your engineers.

What lands in your tracker

Every valid report is delivered as a structured package:

VERDICT: Valid
SEVERITY: High · reasoning attached
REPRO: Confirmed · 6 steps · works on prod-like env
POC: Included (request/response pairs)
DUPLICATE CHECK: No match in program history
REMEDIATION: Object-level authorization check on /api/v2/documents/:id

Want the reasoning behind the process? We write about it constantly. Start with how we triage a single report and how we assign severity.

See the methodology on your queue.

A scoped trial takes one call to set up. You grade our verdicts before committing to anything.

Request a trial