Triage and decisions
Working the triage queue, making decisions that hold up, and what each decision form requires.
The triage queue
Your dashboard lists every Casefile waiting on your team, ordered by severity and SLA pressure. A banner flags critical reports awaiting acknowledgement. SLA breaches show publicly on your track record.
Acknowledge, then triage
Acknowledge stops the acknowledgement clock. Start triage signals you're verifying. If you need something specific, Request information, and say exactly what. Vague requests slow everyone down.
Accepting a finding
Choose the confirmed impact from your locked table. Severity follows automatically. Then describe what you verified.
- If the reward model is a percentage of funds at risk, enter the funds at risk. The reward is calculated and every step is shown.
- If the confirmed severity is lower than requested, you must explain which impact condition wasn't met and which was. The researcher then gets a 48-hour severity rebuttal window.
Proposing a closure
| Outcome | Required |
|---|---|
| Out of scope | The exact exclusion or restriction ID |
| Impact not demonstrated | The PoC requirement or impact ID, plus the missing element |
| Invalid | Why it's not a vulnerability |
| Spam | Evidence of bad faith (the only outcome that penalizes reputation) |
| Duplicate | The earlier Casefile code; the platform verifies it |
| Known issue | A known-issue commitment recorded before the submission |
Every closure opens a 48-hour rebuttal window for the researcher. If they rebut, you make a final decision: uphold or reverse. If you uphold, the researcher may request independent mediation.
Known-issue ledger
Record issues you already know about as commitments. Only a hash is published, so unfixed issues don't leak. When you claim a known issue on a Casefile, the platform checks that the commitment predates the report. You can later reveal the sealed text so the researcher can verify it.
Fix, retest, pay
- Start fix, then Fix ready with a reference (a PR, commit or deployment).
- The researcher retests. If it passes, the reward becomes payable.
- Approve payout, then pay (from your vault, or by recording the transaction).
- Optionally Issue acknowledgement. It becomes part of the researcher's verified profile.
Decisions that hold up in mediation
- Quote the locked rule, not your intent.
- Tie severity to impact conditions.
- Keep all reasoning in the Casefile. Mediators only consider what's on the record.