Triage overall left me relatively disappointed, but by equal measures, relived. I reported a remote code execution to this program in May, the H1 analyst team reviewed and downgraded the severity from critical to high on account of double-counting the UI:R component, in the CVSS. Two weeks after the report was closed as informative quote: "The team has confirmed that the current behavior is working as expected given the trust model of the application." After thorough, and repeated follow up and technical rebuttal the company corrected their initial decision and awarded a bounty payout. The timeline on this report was May 23 → July 9, a whole 47 days, with 27 of those days, it sitting as Informative. Ultimately their turnaround and decision to award the bounty was appreciated and I will continue to engage with them where appropriate. However, to any new researchers on H1, do not pursue this program before you have the signal to request mediation, as without it, you will be entirely at the mercy of the program.
| Month | Sev | Outcome | Why closed | Bounty |
|---|---|---|---|---|
| May 2026 | Critical | Informative | Something else | $2k – $10k |
Log in to comment