Recon Triage
Use when a bug bounty recon phase has produced a large list of hosts/subdomains/endpoints and you need to decide what to look at first. Symptoms: hundreds of lines of subfinder/amass/httpx output, "which of these is interesting", "what should I look at first", "triage this recon", a wall of live hosts with tech/status/port data.
Triage Responder
Use when a submitted bug bounty report gets pushback and you need to draft a reply — statuses like Needs More Info, Informative, Not Applicable (N/A), Duplicate, or a request to demonstrate more impact. Symptoms: "program said needs more info", "they marked it informative", "closed as N/A", "how do I respond to triage", "disputing a duplicate", "they want more impact".
Scope Check
Use when deciding whether a target (domain, subdomain, IP, endpoint, or asset) is in scope for a bug bounty program before testing it. Symptoms: "is this in scope", pasting a program's scope table, wildcard scope like *.example.com, "am I allowed to test this", ambiguous in-scope/out-of-scope rules with carve-outs.
Self Audit
Use when reviewing a web app you own or are explicitly authorized to test — a first-party, defensive security self-review that finds issues, helps you fix them, and writes the regression test so they can't come back. Symptoms: "audit my app", "check my own site for security issues", "self-audit my web app", "what should I test on my app", "review my app before others find bugs", "audit what chang…
Report Writer
Use when writing up a security vulnerability finding for a bug bounty program (HackerOne, Bugcrowd, Intigriti) or a disclosure — turns raw notes about a bug into a structured, triage-ready report with proper impact framing. Symptoms: "how do I write this up", "draft a report", "submit this finding", messy repro notes that need formatting.