Listen to this Post
Introduction
In the high-stakes world of bug bounty hunting, discovering a critical vulnerability is only half the battle. The other half — arguably the more frustrating one — is getting a human being on the other end to acknowledge your work. Security researchers routinely face the “silence problem”: reports that vanish into corporate inboxes, auto-responders that masquerade as engagement, and weeks of radio silence that leave hunters guessing whether their findings are being triaged or ignored entirely. The technical gap isn’t in finding vulnerabilities — it’s in tracking the human communication loop that determines whether a disclosure succeeds or dies.
Learning Objectives
- Understand the structural failure in bug bounty communication pipelines and why traditional tracking methods fail
- Deploy and configure Report-Tracker, an open-source local-first tool that reads Gmail to compute real report status
- Master the escalation workflow, including CERT/CSIRT coordination and 90-day disclosure deadlines
- Implement secure data handling practices for sensitive vulnerability disclosures
You Should Know
- The Rot Metric: Why Submission Dates Are Useless
Most bug bounty hunters track their reports using spreadsheets or platform dashboards. The problem? These tools show you the date you submitted — which tells you nothing about whether anyone has actually read your work. An auto-acknowledgment isn’t triage. A follow-up you sent doesn’t reset the clock. What actually matters is how long it’s been since a human last engaged with your report.
Report-Tracker introduces a single metric: days since a human last said anything. It scans your Gmail, parses the thread history, and classifies each report into one of eight statuses:
| Status | Meaning |
|–||
| `awaiting` | Sent. No response of any kind. |
| `acked` | Automated acknowledgement only. No human has engaged. |
| `in_progress` | A human confirmed they are looking at it. |
| `needs_action` | Blocked on you, not on them. |
| `accepted` | Validated as a real finding. |
| `paid` | Bounty received. |
| `rejected` | Closed. Not accepted. |
| `duplicate` | Closed as a duplicate. |
The distinction between `acked` and `in_progress` is the one that matters most. A robot replying within seconds tells you nothing about triage priority. A human reply three weeks later tells you everything.
What this does: The tool parses email threads, identifies who spoke last, and computes the silence duration. Reports with the longest human silence appear at the top of the sidebar, sorted by “rot”.
How to use it:
Clone the repository git clone https://github.com/harshilnayi/report-tracker.git cd report-tracker Run the server with sample data to preview functionality python server.py Opens http://127.0.0.1:8787 with fictional sample data
The tool binds to `127.0.0.1` and never uploads anything anywhere. This is non-1egotiable for handling unpatched vulnerability data.
2. Gmail Sync Setup: Reading Your Mailbox Safely
The built-in Gmail sync uses OAuth with scopes `gmail.readonly` and `gmail.compose` — it can read your mail and create drafts, but it cannot send. This is deliberate: outbound mail to a security team should always be a human decision.
Step-by-step setup:
1. Google Cloud Console setup (approximately five minutes):
- Create a new project at console.cloud.google.com
- Enable the Gmail API
- Create OAuth 2.0 credentials (Desktop application type)
- Download `credentials.json` and place it in the project root
2. Install dependencies and authenticate:
pip install -r requirements.txt python gmail_sync.py --auth
Your OAuth token lands in `token.json` on your disk and is never transmitted anywhere except Google.
3. Sync your reports:
Dry run first — see what would be detected without writing anything python gmail_sync.py --dry-run Sync the last 12 months of reports python gmail_sync.py --months 12
Alternative — bring your own data: If you don’t use Gmail, `data.json` is a documented JSON schema. Generate it however you like — an AI coding agent with mailbox access, a script against a different mail provider, or by hand.
3. The Follow-Up Queue: Stop Re-Reading Month-Old Threads
One of the most time-wasting activities in bug bounty hunting is re-reading a month-old thread just to figure out what you last said. Report-Tracker generates a follow-up queue — a JSON file containing everything needed to write a good follow-up email without re-reading the entire thread.
Queue structure: Each follow-up entry includes:
- Program name and contact
- Report title
- Days silent
- Full event timeline
- Your private notes
- Tone selection
- Any specific angle you typed
The intended workflow:
After syncing, open the web interface at http://127.0.0.1:8787 Click a report, pick a tone, and the tool writes a work item The queue is saved to follow-up-queue.json
If you use an AI assistant:
> “Check the follow-up queue”
The assistant reads the file, drafts one email per item, and puts them in your Drafts folder for you to review and send. Nothing is sent automatically.
If you don’t use an assistant, the file is a perfectly readable to-do list with the context already gathered.
Manual queue inspection:
View the follow-up queue cat follow-up-queue.json | jq '.'
- Escalation: Doing It Properly (Or Not At All)
When a vendor ignores a valid report for a month, escalating is legitimate and normal. Doing it badly destroys you rather than them. Report-Tracker is opinionated about the difference.
The escalation queue targets published and corporate channels only:
– `security.txt` / `.well-known/security.txt`
– Published role addresses — legal@, privacy@, press@
– Named executives at the company domain, derived from the organisation’s public email pattern
– CERT/CC, or your national CERT, by jurisdiction
– GitHub Security Advisory, for open-source targets
– A dated 90-day disclosure notice, counted from your original report
What it deliberately does NOT do:
- Personal email addresses (executives’ private inboxes, breach dumps, people-search sites)
Why this matters:
- A vulnerability report arriving at someone’s private email reads as a threat, not disclosure. You will hear from a lawyer, not a triager.
- Most safe-harbour clauses require you to stay in the designated channel. Going around it voids your protection — and can be recast as extortion.
- It doesn’t even work as well. A CERT/CC case with a published deadline moves a company that has ignored five emails. A message to the CEO’s Gmail gets you blocked.
90-day disclosure discipline:
The tool computes a 90-day disclosure deadline from your original report date Anything silent 21+ days with no human reply gets flagged
If you set a disclosure deadline, honour it. Either disclose when it expires or formally extend it in writing. A deadline you quietly let slide teaches every vendor that your deadlines are noise.
5. Security: Treat `data.json` Like a Loaded Weapon
`data.json` is the most sensitive file you will ever put on your disk as a bug hunter.
It contains unpatched, undisclosed vulnerabilities in named third-party products, indexed and summarised.
Mandatory security practices:
Verify the file is in .gitignore — leave it there cat .gitignore | grep data.json Never commit it git add . WILL NOT stage data.json if .gitignore is correct Never paste it into an issue, never attach it to a bug report
Git history is effectively permanent. One `git add -f` cannot be undone by deleting the file later. A leak of this file is an uncoordinated 0-day drop against every vendor listed inside it, and the end of your safe harbour with all of them simultaneously.
Same applies to:
– `token.json` — your Gmail OAuth token
– `credentials.json` — your Google Cloud credentials
All three are gitignored. Keep them that way.
- Platform Reports: When Your Report Lives Outside Email
Not all bug bounty reports live in email. Immunefi, HackerOne, Cantina, and MSRC have their own platforms. Report-Tracker handles these through manual entries.
Adding platform reports by hand:
- Open the web interface at `http://127.0.0.1:8787`
2. Click “Add Report”
- Fill in: program name, report title, submission date, platform
4. Set the status manually
- Your edits live in `state.json` and survive every re-sync
Status vocabulary for platform reports:
– `awaiting` — Submitted, no response
– `in_progress` — Triaged or under review
– `accepted` — Validated
– `paid` — Bounty received
– `rejected` / `duplicate` — Closed
7. Linux and Windows Commands for Report Management
Linux / macOS:
Clone and setup
git clone https://github.com/harshilnayi/report-tracker.git
cd report-tracker
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt
Sync and serve
python gmail_sync.py --months 6
python server.py
Background the server
nohup python server.py > server.log 2>&1 &
Check queue files
cat follow-up-queue.json | jq '.[] | {program, days_silent}'
cat escalation-queue.json | jq '.[] | {program, deadline}'
Backup sensitive data (encrypted)
gpg -c data.json
gpg -c token.json
Windows (PowerShell):
Clone and setup git clone https://github.com/harshilnayi/report-tracker.git cd report-tracker python -m venv venv .\venv\Scripts\activate pip install -r requirements.txt Sync and serve python gmail_sync.py --months 6 python server.py Check queue files (using PowerShell) Get-Content follow-up-queue.json | ConvertFrom-Json | Select-Object program, days_silent Get-Content escalation-queue.json | ConvertFrom-Json | Select-Object program, deadline Backup sensitive data (using 7-Zip with password) 7z a -p -mx=9 data.json.7z data.json
What Undercode Say:
- “The silence isn’t personal — it’s structural.” Most bug bounty programs are understaffed, and triage queues are backlogs. The silence problem isn’t malice; it’s capacity. But capacity issues don’t excuse leaving researchers in the dark for weeks. A tool that tracks human engagement rather than submission dates reframes the problem from “they’re ignoring me” to “this report has been silent for X days — time to escalate systematically.”
-
“Automation should augment, not replace, human judgment.” Report-Tracker explicitly cannot send emails. It creates drafts and queue items, but the outbound decision remains with the researcher. This is a critical design choice. In cybersecurity, the human in the loop isn’t a bottleneck — it’s a safety mechanism. Automated follow-ups at scale would flood triage teams and damage researcher credibility. The tool prepares the work; you decide when and how to execute.
-
“Your data is your liability.” The warning about `data.json` isn’t hyperbole. A bug hunter’s local machine contains the most concentrated collection of unpatched vulnerabilities in their possession. Treating that file with the same care as a penetration test report — encrypted, never committed, never shared — is non-1egotiable. The tool’s local-first architecture is a feature, not a limitation.
-
“Escalation is a skill, not a threat.” The distinction between a CERT/CC notification and a CEO’s personal inbox is the difference between professional disclosure and legal exposure. Report-Tracker’s escalation path is opinionated for a reason: it forces researchers to stay in channels that preserve safe harbour. A 90-day deadline that you honour builds reputation. A deadline you ignore destroys it.
Prediction:
-
+1 The silence problem will increasingly be recognised as a supply-chain risk. Organisations that fail to acknowledge vulnerability reports within reasonable timeframes will face reputational damage and regulatory scrutiny. Tools like Report-Tracker that systematise follow-up and escalation will become standard equipment for professional bug bounty hunters, shifting the balance of power back toward researchers.
-
+1 Local-first, open-source tooling for security researchers will grow as trust in cloud-based platforms erodes. The ability to run entirely on your machine, with no data uploaded anywhere, addresses a genuine paranoia in the security community. Expect more tools to adopt this architecture, particularly for handling sensitive vulnerability data.
-
-1 The escalation workflow — particularly the 90-day disclosure deadline — will create tension between researchers and vendors. As more hunters adopt systematic escalation, vendors will face pressure to respond faster or risk public disclosure. This will accelerate the trend toward bug bounty programs being managed by third-party platforms with SLAs, rather than in-house email-based systems.
-
-1 The security of local data stores will become a critical vulnerability vector. As hunters accumulate
data.json-style files containing unpatched vulnerabilities, they become high-value targets for state-sponsored actors and cybercriminals. The industry will need to develop better encryption and secure storage practices for researcher workstations, or risk a wave of 0-day leaks originating from compromised hunter machines.
▶️ Related Video (72% Match):
https://www.youtube.com/watch?v=4A7P4I_CwUg
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Harshilnayi Github – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
