triage-validation

Bug bounty findings are validated using a structured 7-question gate to ensure they meet submission criteria. This process evaluates real-world impact and checks for always-rejected conditions before submission.

Severity assessment for a security vulnerability uses CVSS 3.1 scoring combined with specific program definitions. This determines the accurate severity level by evaluating the real-world impact of the finding alongside its base score.

A security triage validation gate is a 7-question process used to verify the validity and severity of potential bug findings. It is needed before submitting a bug bounty finding to ensure it meets necessary acceptance criteria.

Bug bounty triage requires the bugcrowd-reporting skill for generating reports and the security-arsenal skill for always-rejected checks. These dependencies ensure findings are properly documented and filtered before submission.

The best way to determine real-world impact is through a structured impact assessment during security triage. This evaluates the practical consequences of the finding to assign a correct severity level based on CVSS 3.1 and program definitions.