Triage Lifecycle

What happens after submit on $PROGRAM — states, timelines, and hunter expectations without entitlement.

Triage Lifecycle• Audio Walkthrough

00:00/03:08

Visual · t20_triage_lifecycle

Triage lifecycle = submit → validate → severity → bounty/N/A/dup. Original Cyberlium.

After you click submit, the report enters someone else's queue — learn the lifecycle so you do not rage-quit on day three.

Typical bounty triage lifecycle: submission received → automated checks → human triage → needs more info → accepted severity assignment → fix coordination → bounty payout or duplicate/N/A/invalid closure. Timelines vary by program size — days to weeks is normal; critical production issues may move faster. Hunters track status in platform dashboard; do not open parallel tickets on email/Slack unless program invites it. Cyberlium teaches lifecycle literacy so you plan patience and follow-ups professionally on YOUR $PROGRAM submissions — not harassment, not public shaming on day two, not assuming silence means accept. Defenders juggle patch cycles, legal, and dup databases — your clear report speeds the path.

1. Lifecycle states

New, triaged, needs info, resolved, duplicate, informative, N/A — know platform labels on HackerOne/Bugcrowd/Intigriti class platforms.

Severity may change after internal repro — not personal attack on your skills.

Command guide

Try these commands — Lifecycle states

═══ LINUX / macOS (Web & API Security Testing) ═══

Test HTTP methods on authorized lab endpoint

Command — copy this

for method in GET POST PUT DELETE OPTIONS; do
  curl -s -o /dev/null -w "%-8s -> Status: %{http_code}
" -X $method "http://${LAB_HOST:-127.0.0.1}/api/v1/user"
done

Test JSON API with Authorization Bearer header

Command — copy this

curl -s -X POST "http://${LAB_HOST:-127.0.0.1}/api/v1/profile" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <TEST_TOKEN>" \
  -d '{"id": 1, "action": "view"}' | jq . 2>/dev/null || cat

Check for CORS misconfiguration headers

Command — copy this

curl -s -I -H "Origin: https://attacker.com" "http://${LAB_HOST:-127.0.0.1}/api/v1/status" | grep -i "Access-Control"

Primary tools to practice this lesson: curl, python3. Reference sites: Triage states; Polite replies. Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.