Subject:

The reply is a card, not a one line status. It says which of the 7 stages the report is at and since when, what if anything we need from you with a button to send it, how many updates, appeals and questions you have left, everything you have sent us so far, and what the last email we sent you was.

What the reply looks like:

Report AB12CD34EF56
Stored XSS in the profile bio field
Stage 5 of 7: Bounty Calculation, since 21 Oct 2026

What we need from you: Agree or appeal
Our decision: severity High (score 7.5), bounty 1,500.
Reply AGREE or APPEAL by 20 Nov 2026. After that date the
decision counts as agreed.      [ Agree ]   [ Appeal ]

What you can still send
- Updates you can start yourself: 2 of 3 left.
- Appeals: 3 of 3 left.
- Questions you can still ask: 10 of 10 left.

Open in mail app

Subject:

An index of all your reports. Anything waiting on you is listed first and the "Needs you" column says what; a quiet report shows a dash. Each Report ID is a link that opens a prefilled CHECK email for that report. No Report ID needed to send this one.

What the reply looks like:

Report ID      Title                       Status               Needs you
AB12CD34EF56   Stored XSS in profile bio   Bounty Calculation   Agree or appeal
CC11DD22EE33   IDOR on invoice download    In Review            Send an update
DD44EE55FF66   Open redirect on callback   Completed            -

Open in mail app

Subject:

Your accumulated score, the same number the Hall of Fame ranks you by. No Report ID needed.

Open in mail app
Sample:

Subject:

This page in an email: every command with a one line description, plus, for each of your open reports, how many updates, appeals and questions you have left and what is waiting on you. COMMANDS does the same thing. No Report ID needed.

Open in mail app

Subject: Body:
A summary of what you are adding. Text, a PDF, or both.

Rules: you may start 3 updates yourself on one report. An update you send in reply to a request from us is free and does not count against those 3. Updates close once the report moves past Bounty Calculation to Bounty in Process. One PDF of up to 25 MB.

Open in mail app
Sample:

Subject: Body:
Your question, in text.

Rules: questions only, 10 per report, and a question does not use up an update. Allowed from the moment the report arrives until it is closed or completed. A PDF attached to a question is ignored: send evidence with UPDATE instead.

Open in mail app

Subject: Body:
The information we requested, in text. Attachment:
The signed NDA as a PDF, when we asked for one.

Rules: only after we have asked. The email that asks already carries the right subject and lists the exact requirements, so replying to it is enough. NDA_ still works as the older name for this command.

Open in mail app
Sample:

Subject: Body:
Can be empty.

Rules: only while the report is at Bounty Calculation. The report then moves to Bounty in Process, where we prepare the reward.

Open in mail app
Sample:

Subject: Body:
Your reasoning, in text, a PDF, or both.

Rules: 3 appeals per report. After the third, the valuation standing at that point is final. If we do not hear from you within 30 days of our decision email, that valuation is treated as agreed and the report moves on by itself, so send AGREE or APPEAL before the date the CHECK card gives you.

Open in mail app
Sample:

Subject: Body:
Can be empty.

Rules: only before triage moves past In Review. After that our team is acting on the finding and a fix may already be under way, so ask us instead and we can close it for you. Withdrawing does not affect your score or any other report.

Open in mail app