Use Cases

VulnRap works for anyone who receives or triages vulnerability reports. Here is how different teams use it.

PSIRT / Triage Teams

Before you start reading

Paste incoming reports into the Check page. Get a validity score, duplicate detection, verification results, and redaction analysis without storing anything in VulnRap's database.

Flag reports scoring above 50 for closer scrutiny. These are the ones most likely to describe a theoretical attack rather than an actual finding — deprioritize them accordingly.

Use the API to build a pre-screening step into your triage pipeline. POST to /api/reports/check and auto-tag reports before they hit your queue.

Incoming Report Screening

Catch low-validity reports before they waste triage hours

Run every inbound report through VulnRap as a first-pass validity check. Reports with high scores (likely fabricated) can be batched for bulk review instead of getting individual analyst time.

Detect cross-submission duplicates automatically. If a report matches an existing one at 80%+, your team can close it as a duplicate immediately instead of re-triaging the same issue.

Use the section-level hash comparison to spot reports that copy-paste the same PoC or impact statement across different submissions — a common pattern in spray-and-pray campaigns.

Platform Integration

Reduce noise at the gate

Integrate VulnRap's check endpoint as an intake pre-filter. Automatically score and tag incoming reports before they reach your triage queue.

Use content hash lookups to detect cross-platform duplicates. If the same report has already been analyzed on VulnRap, the hash match tells your team instantly — no manual comparison needed.

Surface validity scores and similarity data alongside incoming submissions so triagers can prioritize high-quality, original reports first.

CI/CD & Pipeline Automation

Automated quality gates for your intake workflow

Add a VulnRap check step to your intake pipeline. When vulnerability reports arrive through automated channels (Jira, email parsers, Slack bots), run them through the API before they create tickets.

Set thresholds: auto-deprioritize reports scoring above 70 (likely fabricated), flag 30–70 for manual review, fast-track anything below 30 to an analyst.

Use the lookup endpoint to deduplicate incoming reports against your historical submissions before they generate new work items.

Report Quality Benchmarking

Measure and track submission quality over time

Use VulnRap's stats page to monitor the overall quality of reports your team is receiving. Track average validity scores, duplicate rates, and submission volume trends.

Identify repeat-offender patterns: if the same report structure keeps showing up with different target names swapped in, VulnRap's similarity detection catches it.

Use the section-level analysis to understand which parts of incoming reports are original research vs. recycled boilerplate. This helps your team decide where to focus review effort.

Vulnerability Disclosure Programs

Strengthen your intake process

Add VulnRap as a pre-screening step in your disclosure policy. Incoming reports that have already been validated save your team time during initial triage.

Use verification URLs to confirm report originality during your assessment process. The VulnRap verify link gives your team an independent quality signal alongside your own analysis.

Monitor VulnRap's stats page to understand submission trends across your program — duplicate rates, average quality scores, and how report quality changes over time.

Case studies

See these scenarios play out end-to-end

Want to see what one of these workflows looks like in practice? Read the worked example of a PSIRT team wiring VulnRap into their intake pipeline — including the thresholds they chose, the integration shape, and illustrative before/after numbers.

PSIRT intake screening|Case-study template

Numbers in the case study are illustrative — composited from internal testing and design conversations, not from a single named customer.

Have a use case we have not covered? We would love to hear about it.

Try it now|See the API|Tell us yours