/
Vulnerability Dispute Process

Vulnerability Dispute Process

Vulnerability Dispute Process Description & Details

 

If you disagree with the final severity rating assigned to your accepted vulnerability report, you can initiate a formal dispute. Here is the step-by-step breakdown of how the dispute process works for researchers:

  1. Overview: To avoid disputes - please demonstrate the extent of negative impact within your original report, prior to it being accepted - this is the ideal scenario.. If you do not agree with the severity rating of your accepted report, you should express this in the report's commentary. The triage analyst will then direct you to file a formal dispute. You can also reach out to the Bug Bounty & Triage Services (BBTS) team regarding disputes via email at programs[at]inspectiv[dot]com.

  2. Filing the Dispute: You will need to file the dispute via an email.  Once submitted, the triage analyst who originally handled your report will confirm receipt of the dispute and it will be reviewed again.

  3. The Golden Rule of Disputes: When reviewing your dispute, the triage team can only review the negative impact and evidence that was already mentioned and demonstrated in your original report. You cannot introduce new evidence, impact, or exploit paths that were not present in the initial submission to argue for a higher severity.

  4. Team Review & Voting: The triage analyst will provide a thorough assessment explaining why the report was given its original severity and tag all members of the Bug Bounty team. The majority of team will then discuss the finding together and vote on one of two outcomes:

  • The report's severity remains as is.

  • The report's severity is increased and an additional bounty is awarded.

  1. Final Decision: You will receive a response with the team's final decision within 5 working days, which does not include requests for more information or clarification. This response will include descriptive, specific reasoning for the final decision.

  2. Resolution & Payout: If your dispute is accepted and the severity is increased, the team will update your original submission with the correct severity and bounty amount, and process an additional transaction to pay you the remaining bounty difference.

  3. Qualification: Please note that disputes are only available to proven and established security researchers on our platform with a minimum of 3 accepted reports with a Low severity or higher.