triage-validation

Validate bug bounty findings by running them through a kill-on-fail triage sequence that checks scope, attacker feasibility, realistic access, novelty, and proof of impact. This prevents wasted submissions by gating out false or known-duplicate vulnerabilities before report drafting begins.

Check for duplicate vulnerability reports by running a deduplication gate that searches Hacktivity, GitHub, disclosed reports, and general search engines. This pre-submission validation step ensures your finding is novel and not already publicly disclosed.

Prevent false positive security findings by enforcing a 7-question gate that verifies attacker steps, program acceptance, in-scope assets, and realistic access requirements. Hard-disqualifying invalid bug classes and demanding real HTTP evidence also filters out unexploitable leads.

Calculate CVSS 3.1 severity using a provided quick reference and a pre-severity gate checklist. This calibration support helps you avoid over-severity ratings when a full end-to-end exploit chain has not been proven.

You should not submit a vulnerability if it falls into a known never-submit bug class or if a chain-required validation fails without a working end-to-end exploit demonstrated. The triage sequence hard-disqualifies these common invalid leads to prevent wasted submissions.