Create a new section "Program Operations" -> triaging

[tolo7010]

Propose a new section for both HackerOners and the programs to have a clear list of indicators on program operations, for example:

• how to decide if a report is a duplicated.
• what are the roles of the security analysts, what are the steps taken in vetting reports.
• how a program decides on the eligibility of a report based on business impact rather than vulnerability or attack types.
• how to determine which assets are considered sensitive and which are not.
• what are the exceptions and when the report is a valid technical vulnerability but not being fixed due to various factors, for example, the complexity or exploitability of the attack, the positive outcome to the victim after the attack, etc. ...

[stacyspiva]

Thanks for the proposal! We'll put your request in to our backlog and work on getting an article written up for this.

[tolo7010]

Hello @stacyspiva, thanks for considering my request. I will try to write some of them with my current knowledge, and sections that need discussing will be marked as [TBD]

[clinboy247]

Hmm good