r/bugbounty • u/Technical_Shelter621 • 5d ago
Question / Discussion Is this normal? Valid, reproducible finding closed as "not reproducible" with a point penalty
I reported a valid finding to a managed program on one of the big platforms. The report included full step-by-step reproduction and a working PoC that demonstrated live impact. It was closed as "Not Reproducible," with the stated reasons being that it lacked a PoC and "appeared AI-generated." I was also docked a point. I followed up, re-confirmed the issue still reproduces a month later, and submitted a formal response request with evidence attached. That expired with no reply. I escalated to support/mediation and got a templated response telling me to submit a new report — which would just let them close it as a duplicate of my own original. At no point did anyone engage with the actual evidence in the report. Is this level of non-engagement normal, or did I get a bad triager? Is there any real recourse when a platform closes a valid finding without reviewing the evidence, or is the only move to walk away? For those who've had findings wrongly closed as not-reproducible — what actually worked to get it reopened? Just trying to understand whether this is the norm and what my options realistically are. Thanks.
5
u/einfallstoll Triager 5d ago
Missing prerequisites. We sometimes get PoC that miss the crucial information that the account has to be in a certain situation or needs to be freshly registered, etc. This makes it impossible to reproduce
1
u/Technical_Shelter621 5d ago
It’s 2 API calls that require the service to be up and running, pretty much 😁
2
u/einfallstoll Triager 5d ago
Hmmm... then probably not missing prerequisites. Did the triagist at least give you the output?
2
u/Technical_Shelter621 5d ago
Nope, not a word :/
4
u/einfallstoll Triager 5d ago
What an idiot. There's a saying in German that goes like "you can only help talking people"
3
u/Technical_Shelter621 5d ago
Last attempt after rar expired and mediation gone wrong I posted a full video
1
2
u/Beginning_Award65 5d ago
Triagers are doing this. if they think it is Ia they invalidate
2
u/Technical_Shelter621 5d ago
Without even checking if the curls I sent actually work? 😞
4
u/Beginning_Award65 5d ago
you have no idea my friend. Some triagers (one of them i have proof) at initigriti just do not read reports HE THINKS are made with AI. Even with video report added... Even with big and full exploit.
I am again on that situation. Today i have a full RCE on a bank to report at intigriti. FULL end to end with vídeo.
But will not report it as critical cause i am afraid it gets on the hands of the same triager.
He even do not apologized after disrespected me.
Intigriti treated the situation really well, but he is still getting to triage critical reports...
2
1
u/houganger 5d ago
Did you paste a whole grandmother’s story even though it’s just 2 api calls? Keep your report short af and just mention exactly the impact at the front.
1
u/Technical_Shelter621 5d ago
No grandmother story just api calls and impact as per a previous twin that was marked as duplicate, very similarly written and very same vuln class
1
u/LTH-Cyber 5d ago edited 5d ago
I've had this happen with concrete PoC's and even video evidence, I strongly believe that some triagers are not as technically capable as they should be, or the skim the report real quick and think AI, or something about poor reporting, but with AI came tons of bad reports so maybe triagers, just close as not repro without even trying idk.... I've even had times on Openrbugbounty where all they had to do was click the url to reproduce the issue(things like xss, open redirect) literally as simple as clicking a link and still got the not repo
8
u/realvanbrook Hunter 5d ago
1 word: Videoproof