Skip to main content
Vuln Triage Agent reviews and validates vulnerability reports from HackerOne, Bugcrowd, GitHub Security Advisories, Security Inbox mailboxes, scanner output, manual input, and imported findings. It assesses exploitability and severity before findings are actioned.

​
What it does

  • HackerOne: fetches reports and internal comments; for automation-started triage, can post an internal Triage Summary (scope)
  • Bugcrowd: reads submissions from synced programs
  • Security Inbox: reads reports sent to a connected security mailbox and applies the mailbox’s triage policy
  • GitHub Security Advisories: reviews advisories synced into Triage
  • Exploitability verification: tests reported issues to confirm they are real and assess impact
  • Security verification: XSS context analysis, server-side checks, and out-of-band testing
  • Sandbox execution: nuclei, curl, and custom scripts for reproduction
  • Web research: related CVEs and exploitation references
  • Issue tracking: correlates results with existing issues

​
How it fits in

Powers Triage: findings from every connected source, deduplication, auto-triage, and HackerOne webhooks.