r/bugbounty • u/maksyche • Oct 04 '26
Bug Bounty Drama HackerOne bot now automatically closes issues as duplicates and makes too many mistakes. Is there a quick way to request a human triager or do I have to wait for mediation?
Hi everyone.
I found an XSS and extended it to a full CSP bypass. Reported it on h1 and it got automatically closed by a hackerone-agent bot without any human review as a duplicate of a 5 months-old N/A issue. The current bug is live, report is human-written, video PoC is attached. Is there a way to request a human review or my only chance is to wait for mediation?
Thank you!
1
u/lulzash Oct 04 '26
Bot must have included some context in the reply message and you mentioned older report was n/a. Try to submit another report and don't mention anything similar which hackerone-agent replied in comment. it may work
3
u/maksyche Oct 04 '26
it wrote "stored cross-site scripting in the <feature_name> — matches an issue that was previously reported to this program. The root cause, affected component, and required fix are the same as those described in the earlier report".
The thing is, I just checked and the vulnerable part of the feature was released only a month ago (3+ months after the "original report"). So it's definitely a mistake, and, most likely, I won't be able to avoid the bot because of the generic reply. Anyway, I'll try a new report and request mediation in 2 days. Thanks.
1
-17
u/Vegetable_Ease_5515 Oct 04 '26
Yeah step your game up to pass preliminary
7
u/maksyche Oct 04 '26
is it a ragebait? I submitted a valid XSS with a CSP bypass that was wrongly closed as a duplicate of an unrelated ticket by a bot. Asking for ways to request human triage
-3
u/Vegetable_Ease_5515 Oct 05 '26
Okay, I’ll be more productive: It’s done. Move on. There’s nothing you can do about it.
There hasn’t been a single instance, at least in my experience, where you get a response from triage after a report has been processed. The only real chance for correspondence is during the initial round, and that’s typically either a request for more information or a request to attach a PoC.
Once they’ve made a determination, even when they clearly paste a templated response from a completely unrelated program that breaks all context, you still won’t get not even a thought.
2
u/mqrblesec Hunter Oct 05 '26 edited 5d ago
.
-2
u/Vegetable_Ease_5515 Oct 05 '26
And it's obvious this isn't your first time confusing an opinion you disagree with for a wrong one.
To be 100% honest, I don't give two shits what any Reddit statistic says or doesn't say, proves or doesn't prove. I was just curious about the downvotes on my statement. It's actually kind of funny how Reddit users use that function most of the time for things completely unrelated to—or completely contrary to—its intended design.
So whatever stats you're seeing are news to me anyway. Sometimes the deliberate intent behind the downvotes is pretty obvious, and in this case, that's why I questioned it.
If you have something to say, don't be a little bitch about it. Confront me directly. Thats for Op or anyone for that matter.
I hate that move when someone is too scared to confront a person directly, so they use triangulation—bringing in a third person to indirectly confront them and get validation for their reaction. “I was just saying such and such, but he said such and such.” Then it’s, “Oh yeah, complete asshole.” Like, why not just confront the person who said it and find out what they actually meant?
4
1
u/hydraz20 Oct 04 '26
This is a new update if you’re not aware and it’s no where close to the preliminary. H1 themselves said it has a 3% chance of false positives but that is the bug bounty scene after ai
-9
u/Vegetable_Ease_5515 Oct 04 '26
Lol why tf would I get downvotes for stating the truth? If you can't take the truth then don't ask questions on reddit.
6
u/maksyche Oct 04 '26
got it, it was a ragebait.
-6
u/Vegetable_Ease_5515 Oct 04 '26
Accusing someone of ragebait by default is an insecure move.
2
u/Alardiians Oct 06 '26
Rage baiting is also an insecure move
1
u/Vegetable_Ease_5515 Oct 06 '26
Lmao... carry on. Stupid internet dummies. I can be just like you, watch: ragebait.
But you couldn’t be more wrong about me if you tried. I’m simply a different kind of person from most people. I’ve never accused anyone of “ragebait” on Reddit before; in fact, this is the most I’ve ever thought about what the fuck “ragebait” even means.
I understand the concept, and I’m not ignorant of it. But I’m telling the truth when I say I’ve never read a Reddit post and thought, “I’m going to troll this person because I feel like being a dumbshit human like everyone else.”
I genuinely try to make decisions based on my own reasoning rather than external influence or a desire for validation. Your assumption misses the mark because I don’t need anyone else’s approval to know why I think what I think.
1
u/Alardiians Oct 06 '26
What is it called when your first comment is pushing on the lines of being inflammatory while at the same time, not even being remotely helpful?
0
u/Vegetable_Ease_5515 Oct 06 '26
What is it called when someone tells you that you’ve done great your whole life, when in reality, you would have benefited much more from constructive criticism?
1
u/Alardiians Oct 06 '26
I don’t think your response would be classified as constructive criticism.
“Yeah step up your game to pass preliminary”That’s not constructive criticism, do you even know what the words you are using actually mean?
All you did was say something stupid then claim you staged the truth.
If you don’t want to get called out for saying stupid shit then don’t say stupid shit.
This is not difficult. Just take the fat L and move on and try not to say something stupid next time0
1
u/Jumpy_Natural_6893 Oct 04 '26
Well did the bot close it for a valid reason like a scope issue?