Feedback

Gate: If you cannot classify, re-read. Every response fits one type.

NMI Procedure (Needs More Info)

1. Identify what they asked - reproduction? evidence? token source? exploitability?
2. Address EVERY point raised, not just the first
3. Respond with this structure:

Hi @{analyst},

## Clarification: {their specific question}
{direct answer}

## Updated Reproduction Steps
Prerequisites:
- Account A (victim): {email}, ID: {id}
- Account B (attacker): {email}, ID: {id}

Steps:
1. {exact URL, not "go to settings"}
2. {exact curl command}
3. Observe: {what confirms the vuln}

## Ambiguous Response Clarification
{if any response looks like failure, explain why it confirms the vuln UPFRONT}

Attached: {screenshot/video/JSON}

Sub-routing:

Gate: Response addresses every point? All evidence attached? Send.

Severity Appeal

Do not argue opinion. Provide evidence:

1. Quote their program's severity policy verbatim
2. Break down CVSS 3.1 metric by metric
3. Reference comparable public H1 reports at the claimed severity
4. Frame impact in business terms (regulatory, financial, user count)

Hi @{analyst},

**Per {program}'s policy:** "{quoted section supporting higher severity}"

**CVSS 3.1:** AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = {score} ({rating})

**Comparable:** HackerOne #{id} - {similar vuln} rated {severity}

I understand you have the final call. Just ensuring full context.

Gate: CVSS calculated? Policy quoted? Comparable report cited? Send.

Duplicate Handler

1. Request the duplicate report ID (you're entitled to it)
2. Check: same endpoint + same vuln class?
3. Check: was the duplicate already patched? If so, yours is independent

If legitimate duplicate: accept professionally, ask for feedback. If wrong:

Hi @{analyst},

Could you share the duplicate report number? My report covers:
- Endpoint: {exact URL}
- Vulnerability: {specific mechanism}

If it matches, I accept the duplicate status.

Gate: Duplicate ID obtained? Same surface confirmed? Accept or contest.

Informative Handler

• Policy-based (they don't consider this class a vuln): Check if accepted elsewhere. Move on.
• Exploitability-based (they don't believe it works): Provide working end-to-end PoC. Update the report.

Gate: Is it policy or exploitability? If policy, stop. If exploitability, prove it or stop.

N/A Handler

• Out of scope asset: Confirm against program scope. Move on.
• Not a vulnerability: Review their reasoning. If wrong, provide counter-evidence. If right, move on.

Gate: Is their reasoning correct? If yes, log in context.md as ruled out. If no, respond with evidence.

Timing Rules

• Respond within 48 hours
• Weekday business hours preferred
• One comprehensive update, never multiple messages before they reply
• Professional tone always - same analysts handle future reports