Duplicate intelligence

Every program that grows eventually pays twice for the same bug. Duplicate detection is therefore a financial control as much as a triage convenience: it decides what gets rewarded, and it protects the program's budget.

Why lexical matching is not enough

Two reports of the same vulnerability rarely look alike. One describes an IDOR on /api/invoices/{id}, the other talks about "invoice enumeration" and attaches a different request. Lexical comparison sees unrelated titles; the vulnerability is identical.

Duplicate intelligence compares meaning and structure, not just text:

• Semantic similarity between report bodies, not only titles.
• Structural signals — endpoint, parameter, component, technique and affected asset.
• Reproduction evidence — where two reports describe the same behaviour on the same target.
• Cross-program correlation — where the same asset is tested by more than one program.

Where it runs in the pipeline

Detection happens at submission time rather than after validation. That ordering matters: flagging a likely duplicate before anyone spends review effort saves triage time, and it avoids a reward decision that has to be reversed later.

1. A report is submitted.
2. The pipeline classifies it and searches for overlapping reports on the same asset, and across the program family.
3. Likely duplicates are surfaced to the triage team with the overlapping reports attached.
4. The triage team decides: merge, mark duplicate with attribution, or treat as distinct.
5. The decision and its rationale are recorded on both records.

The system proposes; a human decides. Automated duplicate marking is deliberately not the default, because attribution questions are contractual, not technical.

Scoring and false positives

Similarity is presented as a ranked signal, not a verdict:

• A high score with matching endpoints and parameters is usually a duplicate.
• A high score with different endpoints usually is not — the same weakness class on a different component is a distinct finding.
• A low score never suppresses a report; nothing is auto-closed on similarity alone.

Programs tune their sensitivity, and every automated suggestion that a reviewer overturns is retained as feedback.

Effects on program economics

• Fewer double payments for the same underlying issue.
• Less review effort spent on reports that will not be rewarded.
• Cleaner severity history — one merged record carries the full discussion instead of two partial ones.
• Better researcher experience on genuine duplicates: an early, explained decision beats a silent rejection weeks later.

Availability and limits

• Duplicate intelligence is Professional-tier. Programs on lower tiers can still mark and merge duplicates manually.
• Cross-program correlation applies to programs under the same organisation; it does not expose one customer's data to another.

Related docs

• Triage pipeline — the states a report moves through
• AI assistance — the wider set of automated capabilities
• Payouts and KYC — how a reward decision becomes a payment