A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
The source gives a deliberately restrained communication rule: after submitting a report, allow the security or triage team time to validate the finding and ask questions. Some programs publish vendor response SLAs or response-efficiency metrics. The practical lesson is simple—do not turn a waiting period into a stream of repeated messages.
The source explicitly advises against contacting security or triage teams through unofficial channels such as social media. Once a team member responds, record their username and use that person as the context for future communication when appropriate. This preserves the submission's audit trail.
A professional disagreement is still part of the report process. Do not respond to a severity or bounty disagreement by escalating emotionally or bypassing the program's published communication route.
The source suggests a structured response: explain the rationale for your CVSS score, walk through the metric values, revisit the program policy and scope, and ensure the bounty amount aligns with the published policy. If the issue remains unresolved on a platform that offers mediation, the source identifies mediation as a possible next step.
A triage analyst is not just judging whether the vulnerability exists. They are deciding whether the evidence is sufficient, whether the severity follows from the evidence, and whether the submission complies with policy. A calm response with explicit rationale is more useful than repeating the same claim.
| Poor response | Professional response |
|---|---|
| 'This is critical because I said so.' | Explain the observable impact and map it to each severity metric. |
| Repeated pings after submission | Wait for the program's stated response window or a reasonable period. |
| Private message on social media | Use the program's official communication channel. |
| Threatening escalation | Use the platform's documented mediation process when applicable. |
Keep disputed-severity replies evidence-first: identify the affected component, summarize the observed consequence, state the metric rationale, and point back to the program policy. The goal is to make the disagreement smaller by making the reasoning more explicit.
Professional communication is part of the research record. Treat every message as something another security professional may need to understand later.
Finish the lesson once you have worked through the material. This awards ★ 30 XP.