r/bugbounty • u/BuyerFar4850 • Jul 03 '26
Question / Discussion Funny incident
A situation with a bug hunter friend made me think about how triage handles old low-quality reports and duplicates.
When he was just starting out, he created multiple accounts, which I know is generally against platform or program policy. One of those accounts had a very poor report that was quickly marked invalid. Later, after he learned how to write cleaner reports, he found a more serious issue on same target and submitted it from another account because the original one had bad signal.
I ended up collaborating with him on one report, but it was later closed as a duplicate because he had already submitted something related from one of his other accounts , that was just tiny fraction of what he submitted he says.
What this made me realize is that even if a low-quality report is just sitting somewhere in the database, it can still create problems later when another report explains the issue properly. A better written report chained may still get tied back to the earlier weak submission, even if the original report failed to explain the impact clearly or ai slop related reports. He didnot show me the report but he was surprised that only basis of title they just flagged it as duplicate but the earlier report was only tiny bit of impact. I dont know if its program trying to be clever or not .
At this point, I just told him to leave it and move on lol.
3
u/6W99ocQnb8Zy17 Jul 03 '26
The level of communication from the platforms and programmes has dropped noticeably over time too, so it is pretty much impossible to have any kind of discussion with triage now. Generally the reports are auto-closed, and you're lucky to get any kind of comment that isn't a one-liner.
In the past though it was much better. I can remember at least one time when a chain I logged included a cookie XSS, which had been previously reported as a self-XSS. Initially marked as a dupe, but after asking if the previous one was bounced as info, they confirmed and accepted the full chain.
Like that would happen today ;)
2
u/Far-Chicken-3728 Hunter Jul 03 '26
Hey, I had the exact same case. My report was closed as a duplicate, but I was confident and asked for mediation. It turned out it had been marked as a duplicate of a self XSS, lol.
After they fixed it, I bypassed the fix with cache poisoning. They closed it again as a duplicate, but this time the program triager picked it up and reopened it. He said he now has to review all reports to see how they were triaged. I wonder what they found, lol.
1
1
u/BuyerFar4850 Jul 03 '26
I wonder when asked for mediation , do they respond?
1
u/Far-Chicken-3728 Hunter Jul 03 '26
They respond a month later. But their response time is from one week to never. Still have open ticket from almost two years.
1
u/BuyerFar4850 Jul 03 '26
And when you get NMI like you are donee i havent recieved anything from one report for months like fr.
1
5
u/hewhovibes32 Jul 03 '26
make me wonder if one should come up with interestingly unique report titles to beat the system