After you submit a private vulnerability report, the receiving organization or platform acknowledges it and assesses whether the issue is in scope, reproducible and significant. It may ask for more evidence, send a credible report to the affected product team, and coordinate remediation. Submission does not guarantee a fix by a particular date, public disclosure or a bounty; those depend on the applicable policy and program.
What happens to a report after submission?
The exact workflow depends on where you reported the issue: directly to an organization, through a third-party platform, or to a coordinator that works with multiple suppliers. The usual stages are receipt, triage, investigation and a decision about remediation and closure, but the people involved, status labels and response commitments are not universal.
As an Amazon Associate I earn from qualifying purchases.
- Receipt and acknowledgment: Your report enters the channel named in the policy or program. There is no universal deadline for acknowledgment. For example, get.gov’s vulnerability disclosure policy promises acknowledgment within three business days if you provide contact information. HackerOne’s post-submission guide describes an automated receipt confirmation immediately after submission, while noting that timelines vary.
- Triage and validation: The receiving team checks whether the affected system is in scope, whether the issue can be reproduced, what its plausible impact is, and whether it needs more information. It may also determine that the issue is already known, publicly disclosed, or not actionable through that channel. A report outside the recipient’s remit may be referred or closed.
- Investigation and coordination: If the report is credible, it may be sent to the team responsible for the affected product or service. In a coordinator-led process, the coordinator may contact the supplier, seek confirmation, track progress and help resolve communication problems between the supplier and reporter.
- Remediation or mitigation: The affected organization investigates and decides how to address the issue. That could involve a fix or another mitigation, and the team may ask you for clarification. There is no single deadline that applies to all private reports. get.gov says it will, to the best of its ability, confirm a vulnerability and communicate remediation steps and delays; that commitment applies to get.gov, not to every organization.
- Closure and any reward decision: A platform or organization may close a report after making a decision or completing remediation. A bounty is possible only where the relevant program offers one and the report meets its eligibility rules; an award is not guaranteed simply because you submitted a report.
Who handles triage depends on the reporting route
| Reporting route | Who may receive and assess the report | Coordination and public release | Reward and confidentiality |
|---|---|---|---|
| Direct organizational vulnerability disclosure policy (VDP) | The organization named in its policy receives the report and determines whether it is in scope and actionable. The policy sets the organization’s stated commitments. | A VDP explains how to report and what to expect, but does not necessarily provide cross-supplier coordination, remediation or an advisory. | Check the organization’s policy for confidentiality and reward terms; a VDP does not by itself promise payment. |
| Third-party bug bounty platform | The platform provides the reporting channel, while the organization running the program assesses the report under that program’s rules. The platform’s general process does not replace program-specific terms. | Disclosure settings vary by program. A report being closed or fixed does not itself authorize public release. | Some programs offer bounties; eligibility and payment are governed by the individual program. Private programs may impose confidentiality requirements. |
| Coordinator-led coordinated vulnerability disclosure (CVD) | A coordinator may assess whether a case is suitable for coordination, contact the affected supplier and help validate and track the issue. | CISA’s CVD model can include coordination, a decision about a CVE record, advisory preparation and possible public disclosure. That is a particular coordinator process, not the default for every private report. | Do not assume that a coordinator’s involvement creates a bounty. Confidentiality and disclosure follow the policies governing that case. |
Why a report may be delayed, referred or closed
Submission starts a review; it does not mean the recipient has confirmed the vulnerability. A team may need enough detail to reproduce the issue, establish realistic impact or identify the product owner. It may also find the target is outside the program’s scope, the issue is already known, or the report is not actionable through that channel. In those cases, the report may be referred or closed rather than handled as a confirmed vulnerability.
Response and remediation times vary by organization and issue. A policy-specific deadline should not be treated as an industry-wide service level. For example, CISA’s described coordination process says disclosure may occur as early as 45 days after first contact when a vendor is unresponsive or will not set a reasonable remediation timeframe. That conditional CISA process is not a general deadline for bug bounty reports or private programs.
#1 Best Overall
Will your report stay private?
Usually, a private report is handled under the disclosure and confidentiality terms of the reporting channel and program. HackerOne’s disclosure guidelines say reports initially remain non-public to give the security team time to remediate, but later disclosure depends on program settings. Some private programs require confidentiality by default. Read the specific terms you accepted: a platform’s general guidance may be supplemented or superseded by a program’s rules.
A fix does not automatically make a report public. Before publishing details, check the program’s disclosure setting and obtain any approval its policy requires. In a coordinated disclosure process, timing may depend on remediation progress, exploitation status, potential impact, supplier responsiveness and available mitigations.
Quick Recap
Best Value
Rank #3
What to do while the report is being reviewed
- Follow the rules you agreed to: Check scope, rules of engagement, confidentiality terms and the disclosure policy before testing or reporting. Keep testing within authorized limits.
- Make the report easy to validate: Include the affected system and conditions, clear reproduction steps and a realistic explanation of impact. Add proof-of-concept material where appropriate, but do not include unrelated sensitive data.
- Stop when you have established the issue: Do not use an exploit to access or extract data, persist, pivot to other systems or disrupt a service. get.gov’s policy specifically prohibits those actions.
- Reply through the designated channel: Provide reasonable clarifications and keep updates in the report thread or other contact path specified by the program. HackerOne recommends keeping report-related communication on its platform and describes mediation for disputes.
- Wait for permission before disclosure: Do not assume that a fix, report closure or elapsed time gives you permission to publish. Follow the program’s disclosure terms.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
