Skip to content

Instantly share code, notes, and snippets.

@EdOverflow
Created May 22, 2020 13:19
Show Gist options
  • Save EdOverflow/6b41927f8e763f65f4651211af5d8ccf to your computer and use it in GitHub Desktop.
Save EdOverflow/6b41927f8e763f65f4651211af5d8ccf to your computer and use it in GitHub Desktop.

As an ex-triager what advice would you give to everyone?

Don‘t write an essay; get to the point. In other words, address the Five Ws in your opening paragraph. Do not waffle on about the issue, your life, your pet cats... oh and did I tell you about Mike‘s pet frog?

From personal experience, triagers typically have to triage around 180 reports a week (this may be more now ... I am looking at you, still). Do you think triagers want to hear what Wikipedia has to say on XSS?

Without breaching the terms of the bug bounty program‘s policy, focus more on the exploitability of the issue by illustrating this in your proof of concept rather than emphasising the type of vulnerability you are reporting. Let the impact do the talking; not the bug class. If you end up disagreeing with the final bounty amount, highlighting your description of the exploitability allows for civil discourse. You do not end up arguing hypotheticals with the program.

What was the worst report you wish you never had seen?

I once accidentally opened a NSFW report from the pre-submission inbox. The rest is left to your imagination. My reaction could be best described as:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment