Communicating With Triagers: Tips That Shorten Time-to-Bounty
Triage is not your adversary. They are the bottleneck between you and money, and they juggle incomplete reports all day. How you write determines whether your bug moves or sits in "Needs more info" until you forget it exists.
Lead with the ask
When they comment "can't reproduce," do not paste a manifesto. Answer:
- Did you use the same role and environment?
- Which step diverged on your side?
- Here is a narrower PoC (attached)
Number your replies to their numbered questions. Mirror their vocabulary (asset, weakness, severity) so nothing gets lost in translation between platforms.
If you need info from them — "is staging-eu in scope?" — ask once, clearly, and keep hunting elsewhere while you wait. A ticket that only exists to ping "any update?" every twelve hours is how you earn a quiet reputation you will not like.
Keep emotion off the ticket
"N/A – Informative" stings. Sleep on the angry draft. A useful pushback cites policy text, a second PoC, or a public advisory pattern that matches your path. Sarcasm locks the report and sometimes the relationship with that program.
Same rule when someone else duplicates you by an hour. Congratulate, ask to be marked as collaborator if policy allows, move on. Public whining about triage quality ages poorly and recruiters can read.
If you believe triage missed impact, restate impact in one paragraph with a new artifact — not a longer version of the same paragraph.
Package updates so they can skim
Subject-style first line: "Updated PoC: race now hits ~8/10 with the attached script." Then details. Attachments named repro-step3.png beat Screenshot 2026-08-17 at 2.41.09 AM.png.
If you discover the blast radius is wider than filed, say so early and separate the new path from the original steps. Silently rewriting a report into a different bug class confuses timelines and duplicate checks. Open a linked report when policy says the new path is a separate issue.
Quote only the lines of their question you are answering. Walls of requoted history make mobile triage miserable.
Cadence matters
Reply within a day when they ask for something you can provide. Silence reads as abandonment and some programs auto-close. If you need a weekend, post a one-liner: "Retesting Sunday with a fresh account."
When a fix lands, retest promptly and close the loop. Engineers notice researchers who unblock release trains.
When severity talks get sticky, separate facts from feelings. Restate the demonstrated impact in one paragraph, attach one new artifact, and ask which CVSS metric they disagree with. That turns a fight into a checklist.
Triagers remember people who make verification cheap. Be that researcher on purpose. Your reputation is a long game across programs that talk to each other more than you think.
One more habit: thank them when they catch a mistake in your steps. Collaborative tone shortens the next ticket too. Nobody wants to fight a researcher who writes like a teammate.