Duplicates Are Part Of The Process

Duplicates Are Part Of The Process Watch on YouTube

You put two days into that report. The report was clean, the impact was real, and hitting submit actually felt good for once.

Then triage comes back with one word. Duplicate.

That's been most of my last few weeks. Bugs I'd normally be happy with. A few highs. A couple of criticals. Paid nothing. There was a point in there where I nearly stopped hunting altogether.

So I stopped and went and read what the status actually means. It isn't a rejection. Out of every way a program can close your report, it's the only one that confirms the work. The bug is real. The scope covers it. The program pays for it. You just weren't first.

TL;DR

• Duplicate means the bug is real and someone filed it before you. Every platform says that in writing.
• It doesn't belong with informative, not applicable and out of scope. Those three say your finding was wrong. Duplicate says it was right.
• YesWeHack still gives you ranking points for a duplicate. An out of scope closure can take points off you. That gap tells you how the platform reads them.
• Informative and out of scope are preparation, not luck. Read the policy, file what's in scope, stop sending the rest.
• You can't get duplicates to zero, and zero isn't the target. They show up because you're finally hunting where the paid bugs are.
• Depth cuts duplicates. Speed doesn't. Four steps into a chain there's nobody left to collide with.

The Run That Paid Nothing

Most of my year has gone into private programs. They don't pay like the big public ones, but there are far fewer hunters in there. That trade has worked for me.

Then you look at what the public programs are paying and the question starts nagging. Why am I not in there?

So I went. A public program everyone knows. I put the hours in, got properly deep into the app, came out with a pile of findings, and filed all of them.

All of them came back duplicate.

Here's what I missed at the time. Nothing came back informative. Nothing was ruled out of scope. Not one report got thrown out for being wrong. All I saw at the time was the same word repeating down a column.

So I went back to the private side. Found a good program, started testing, filed two reports. They were turning reports around in under a day. Fast. I took that as a good sign.

Twenty minutes later, both were closed. Duplicate.

Then I moved again, and I want to be precise about what moving means, because people say it like it costs nothing:

• I didn't pull a new name off the program list.
• I went back to a target I'd already hacked on.
• I already know that app, including which features are a waste of time.

That isn't starting from scratch. It's another room in a building you've already mapped.

Then I took on a program I'd never touched. That one was the best stretch of the whole run. Bugs I had to sit with. Classes I rarely get to land. A few highs, a couple of criticals.

All duplicates. I think one of them reached triage before it closed.

Most platforms show you the gap when a report closes that way, so you know exactly how close it was. Most of mine were a day or two behind.

One of them, I missed it by an hour.

An hour, against two days of my work.

A Duplicate Is Not A Failed Report

That's the question I finally sat down and asked myself. The answer was shorter than I wanted it to be.

There isn't one.

Someone got there before me and filed before me. That's the whole story. Those are the rules of the game and I knew them before I signed up. If a program decided to pay me anyway, I'd turn it down. It isn't my finding. Someone else got there first.

Then I did the thing I'd tell anyone in that hole to do. I opened up my first year of reports.

Roughly the same volume. The same wall of closures. Completely different words on them.

Informative. Not applicable. Out of scope.

That's what flipped it for me.

What Each Closure Reason Actually Means

Put the statuses side by side and the split is obvious. These are the definitions platforms publish, not my reframing of them.

Three of those say you got something wrong. One says you got it right and arrived late.

This isn't me spinning it in my own favour. The definitions are public. Here's how YesWeHack, who I work with, put it in their help center:

the vulnerability exists but has already been reported, either internally or within your bug bounty program

The vulnerability exists. That's their wording, not mine.

The same page says duplicate reports still give ranking points to the hunter. Out of scope sits in the group that can push your score down instead.

Nobody pays reputation for work they think is worthless. That gap in the scoring tells you how the platform reads a duplicate, and it's clearer than anything I could say about it.

One meaning, start to finish. The bug was right and you were late.

Which Closures You Can Actually Prevent

Now the half you can actually control.

You can get informative and not applicable almost down to zero. Those two are preparation, not luck:

• Read the policy properly, all the way through, exclusions included.
• Know what the program pays for and what it refuses.
• File what's in scope and nothing else.
• When you find something the policy doesn't list, you already know the answer. Keep it.

An out of scope report is worse than a wasted one. On YesWeHack it can take ranking points off you. So it costs you twice. Once in hours, once in standing.

Duplicates are different. You can't get rid of them, and you shouldn't be trying to. They start appearing because you're finally working where the paid bugs are.

You can still bring the number down. Not by racing everyone. By carrying on past where everyone else stops.

Think about where collisions actually happen:

• The visible parameter.
• The first endpoint in your proxy history.
• The feature on the front page.
• Whatever the last popular writeup pointed everybody at.

That's where everybody is standing, so that's where everybody collides.

The bugs nobody duplicates look nothing like that:

• The ones sitting four steps into a chain.
• The chain that stops being interesting at step two, so most people drop it there.
• The flow you can't reach until you've spent twenty minutes setting up.
• The state that only exists after you've used the product like a real customer.

Collisions need company. There isn't any down there.

Submitting Is One Step Out Of Five

How much a duplicate hurts comes down to one more thing, and it isn't in the report. It's what you count as a win.

If what you're after is finding a vulnerability, be honest about it. You found one.

A duplicate is a valid finding. It's not informative and it's not out of scope. A real company read it and agreed the bug was there. That's not a consolation prize. It's exactly what you set out to do, confirmed by people who can read the source code.

If what you're after is the money, that's fine too. That's most hunters and there's nothing wrong with it. You just have to be honest about what submitting actually is.

It isn't the finish line. It's the last link in a chain, and you already won the first four.

You got four of those five right. The fifth came back marked duplicate.

Now go down that list and mark what's actually yours. You don't decide who else picks the same target. You don't decide what time they start work. Two things are yours:

1. How many attempts you get in.
2. How far you dig before you stop.

That's the whole list.

What A Duplicate Tells You About The Target

Read a duplicate as information instead of a verdict and it pays you back.

It hands you two facts. That area produces real bugs. Someone else is standing in it right now. Neither one is a judgement on you, and both are worth having.

Both routes keep you moving. Either you go further into that target than the person who beat you bothered to go, or you take the technique somewhere with fewer people in it.

I write the thing down before I close the tab. It takes a minute, and it stops the work disappearing:

## DUP: [program] / [feature]

- Bug class:
- Margin I lost by:               (hours / days)
- Confirmed by this closure:      feature is live, reachable, in scope
- Who else is here:               at least one hunter, working this area now
- Deeper angle not yet tested:
- Same class, quieter target:

That note is worth more than the report was. The report paid nothing. The note gives you two places to go next.

The only closure that really ends a run is the one that stops you opening the laptop.

What To Do When You Hit The Wall

This is the part I most want you to take away, because this is where I nearly quit.

There's a point where you've stopped thinking and you haven't noticed yet. You're just clicking. The same request has been on your screen four times now and nothing is landing.

Stop there.

What not to do, in order of how tempting it is:

• Don't slam the laptop shut and write the day off.
• Don't go looking for a new tool to install.
• Don't jump to a different program.
• Don't swap activity for thinking.

None of it is any good, and part of it you'll be cleaning up tomorrow.

What to do instead:

1. Stand up.
2. Get away from the screen.
3. Leave the phone behind too.
4. Stay away ten or fifteen minutes. Long enough to get bored. Bored is when your brain starts working again.

Come back, and it usually lands inside the first few minutes. Send it in reverse. Point that redirect somewhere else. Chain it with that thing from yesterday.

That idea has never once shown up while I was still sitting in front of the screen.

A Duplicate Is A Receipt, Not A Rejection

So that's the run. A column of duplicates, nothing earned, and two days of my life gone.

That month doesn't read as a failure to me anymore. It reads as confirmation. Right programs, right depth, and the people I'm competing with are genuinely good. The only piece missing is getting there first. It'll happen on one of them. It'll happen for you too.

I'll be straight about why I wrote this. It all happened within the last few weeks. Still fresh, and it got under my skin more than I expected. I sat there properly annoyed at a screen full of unpaid work.

I kept going anyway, and not because I'm built tougher than anyone reading this. The moment those closures made sense, the annoyance had nothing left to hold on to.

If that's where you are today, take it from someone who was in it last week. Nothing has gone wrong. You're doing this right, and you're just early.

A duplicate ends nothing. It's a receipt. Proof the work was good enough that someone sharp had already done it.

Keep going. Take one more step than whoever is ahead of you took.

One of them will come back with only your name on it.

Further Reading

• YesWeHack, Vulnerability Reports Workflow and status definitions
• YesWeHack, a quick update on our ranking point system
• HackerOne, reputation documentation
• Intigriti, leaderboard reputation and streak
• YesWeHack, Vulnerability Reports