Communicating with triage

When it applies

The report is in and now it's a conversation. How you handle triage largely decides the outcome — a valid bug can be closed over a bad thread, and a borderline one can be paid with a clear, calm one.

Why it works

Triagers process a queue under time pressure and act on what's in front of them. A report that reproduces from the steps alone, and follow-ups that answer the exact question with evidence, remove every reason to close it — while professionalism keeps the relationship (and your reputation) intact.

Method

1. Pre-empt questions in the report: exact requests/responses, account roles, a clean-session repro, and a crisp impact statement — most "need more info" rounds are avoidable.
2. When asked for more: give precisely what's requested (a fresh repro, a video, the missing header), not a wall of text. Re-confirm from a clean state.
3. Duplicate: ask politely for the dupe reference and compare — if yours is genuinely distinct (different root cause, endpoint, or a working chain where the original was theoretical), lay out the difference factually. If it's truly the same, accept it and move on.
4. Not applicable / won't fix: restate the demonstrated impact and, if needed, escalate the PoC to show real consequence (stay in scope). Don't argue theory — show it.
5. Severity dispute: bring the CVSS vector and the program's own scale (reporting-cvss-scoring), and justify the contested metric with what you proved.
6. Escalate correctly: use the platform's mediation/escalation path when stuck; keep it factual.

Gotchas

• Never threaten public disclosure or go around the process — it voids safe harbor and burns you.
• Tone is leverage: rude threads get minimal effort; respectful, evidence-first threads get benefit of the doubt.
• Don't keep pushing a genuine dupe or a truly out-of-scope report — it costs goodwill you'll need later.

Verify success

The thread moves toward resolution on the merits: your follow-ups answered the actual question with evidence, and any dispute is argued from demonstrated impact and the program's own policy.

References

Platform mediation/disclosure guidelines; the reporting-bug-bounty-writeup, reporting-cvss-scoring, and tradecraft-bugbounty-platforms skills.