Bug Bounty Triage: Valid Findings Paid From the Weekly Budget, Reversals Included

A bounty week where every finding stands on its own

A bug bounty week starts with a batch of submissions and a fixed payout budget. Each submission is checked for scope, matched against known GitHub issues for duplicates, reproduced and given a disposition. Valid findings are paid by severity until the budget runs out, and whatever is left is kept for findings that become valid later in the week.

Submissions are filed in ClickUp, known issues live in GitHub, past payouts show in Stripe, researchers write in through Gmail, and the triage policy and payout manifest sit in Google Drive. Midweek, a reproduction arrives, a root-cause memo moves a finding, a scope addendum brings two targets in, and the budget has to be re-allocated from what was left, not from the full amount.

Who works in the room

Triage is the room's default work, so messages that name no agent go to Nova. Payout questions go to Fin, which owns the allocation and the manifest, and Ada handles researcher email. When a researcher replies with a reproduction, Ada hands it to Nova in the thread. When Nova re-classifies a submission as valid, it mentions Fin with the severity and the reason, and Fin allocates from the remaining budget.

Batch, budget, reversals, closeout

An automation opens the batch in the room every Monday. Nova reads each submission's own target, component, reported severity and notes, and never copies a disposition from the submission next to it.

Reversals after the money is allocated

Two researchers reply on their original Gmail threads with working reproductions for findings marked as needing one. Ada brings both into the thread, Nova re-runs them under the policy, and both come out valid. Fin allocates them from the budget left after the first allocation, not from the full weekly amount, and Ada drafts one reply on each thread with the submission ID and the payout in whole dollars. The security lead sends them.

The root-cause memo and the scope addendum reopen three more. A finding closed as a duplicate turns out to have its own root cause, and two submissions against targets the addendum brings into scope get a fresh look. Each is re-run under the policy and, if valid, paid from what remains. Later, a GitHub readback shows the match for SUB-17 was wrong, so Nova re-checks it without that match and confirms the five other matches the memo names. ClickUp changes only after the security lead approves.

What the checks catch

• Placeholder entries in the ClickUp list treated as submissions and given a status
• A disposition copied from a neighboring submission that targets a similar component
• Late valid findings paid from the full weekly budget instead of what remained after the first allocation
• A manifest line for a submission that is no longer valid, or a payout that differs from the allocation
• Closeout totals that leave out a Stripe balance transaction already on record for a researcher

What stays with people

• Approving every disposition and payout before ClickUp is updated
• Reproducing findings and confirming root cause
• Sending every researcher reply, which Ada drafts in Gmail
• Releasing payouts, which stays with finance

Integrations in this workflow

Kylon is not a bug bounty platform and it does not replace one. It sits across the tracker, the repository and the payment records the security team already uses, and keeps the triage, the budget and the replies in one room.

• ClickUp
• GitHub
• Gmail
• Google Drive
• Slack
• Stripe

• ClickUp holds each submission with its fields, status and payout, plus the Bug Bounty Ops entry for weekly comments
• GitHub holds known issues, which Nova reads as evidence for duplicates and matches
• Stripe shows each researcher's past payouts and balance transactions, read as evidence only
• Gmail carries researcher threads, answered through drafts the security lead sends
• Google Drive keeps the triage policy, the payout manifest and the week's notices and memos
• Slack is where security engineers post reproduction results and root-cause findings

Where to start

Open the room with one week's batch. Connect the ClickUp list where submissions are filed, give Nova read access to the GitHub organization, and put one rule in the room guidelines: agents propose dispositions and payouts, and the security lead approves every one before ClickUp changes or a researcher hears back.

“Late findings were paid from what was left of the week's budget, and the closeout matched what Stripe already showed.”

Set it up with your agent

Open a new Room, add your agent and paste this prompt. It connects the tools, builds the App with you and asks for your rules one step at a time, and nothing goes out until a person approves it.