Your security@ inbox, ranked and deduplicated, with the real bugs reproduced: US$49 a month planned
Status: waitlist, not yet available. Nothing here takes payment and no service runs yet. The button below only tells us you want it.
For small software vendors and open-source maintainers who get vulnerability reports by email or GitHub and are not on a bug bounty platform. You would forward the inbox or connect a repository's advisory feed. Each report would come back in one ranked queue with three things: whether it duplicates an earlier one, a reproduction note, and a suggested reply you edit and send yourself.
Why reproduction is the part that matters
We gave a free chatbot 20 real public curl reports on HackerOne (8 valid with a CVE, 8 closed as invalid or spam, 4 duplicates) and asked it to say whether each was real, a duplicate, and to draft a reply. It matched curl's own outcome on 12 of 20. It sorted all 4 duplicates and 6 of the 8 invalid ones, but answered "unsure" on 6 of the 8 valid reports, because it could not run the code. A queue that says "unsure" on real bugs does not save a maintainer's time. Limits of that test: one project, 20 cases, the public reports may sit in the chatbot's training data, and "unsure" was scored as a rejection.
Sample queue, built from public reports only
This is a demonstration assembled from separate public sources, not one real inbox and not any customer's data. Ranked by what a maintainer should open first.
| # | Report | Triage | Suggested reply (draft) |
|---|---|---|---|
| 1 | curl, HackerOne 3591944, use after free in SMB connection reuse, filed 8 Mar 2026 11:32 UTC | likely real Resolved by curl as CVE-2026-3805. Not reproduced by us: the outcome comes from curl's public record. Ranked first because it is the earliest of two reports of one bug. | "Thanks, we can see the dangling pointer after connection reuse. We are checking it against the current release and will confirm severity and a fix timeline." |
| 2 | curl, HackerOne 3591956, SMB connection reuse dangling pointer, filed 8 Mar 2026 11:47 UTC | duplicate of #1 Filed after #1 (11:47 against 11:32 UTC), same code path. curl closed it as a duplicate of 3591944. Group, keep the second reporter's extra detail, do not triage twice. | "Thanks, this matches a report we received a few minutes earlier. We are handling it there and will credit both of you if you agree." |
| 3 | urllib3, CVE-2023-43804, Cookie header sent to another origin after a redirect (urllib3 before 1.26.17) | reproduced by us See the reproduction note below. Ranked above a closed-as-spam claim because it runs. | "Confirmed on 1.26.16 with a local two-server test: a Cookie header set on the first request reaches the redirect target. 1.26.18 does not send it. We are shipping the fix and will list the affected versions." |
| 4 | curl, HackerOne 3418528, stack overflow claim with "PoC + ASan" in the title, filed 10 Nov 2025 | likely invalid curl closed it as spam. Not reproduced by us; the call is curl's recorded outcome. A claim of sanitiser output without the output attached is a reason to ask for the build and the command before spending time. | "Thanks. We could not match this to a path in a supported build. Please send the exact commit, build flags and the command that produces the sanitiser output." |
Report titles are as shown on the public pages when we read them on 9 Nov 2026; curl renames accepted reports. We link the reports and copy no report text.
Reproduction note for #3 (done by us, 9 Nov 2026)
Public advisory: a request that carries a Cookie header and is redirected to another origin keeps the header in urllib3 before 1.26.17. We ran two local servers on 127.0.0.1 and localhost, the first answering 302 to the second, with urllib3 installed from PyPI and a client sending Cookie: session=SECRET to the first.
urllib3 1.26.16 cookie seen by other origin: session=SECRET urllib3 1.26.18 cookie seen by other origin: None
That is a 20-line script on our own machine against a public release, with no third-party server touched. Real inboxes hold bugs that need the reporter's setup, so a reproduction would not always succeed; when it does not, the note would say what was tried and the report stays ranked as unconfirmed.
Price and what is planned
Planned: US$49 a month per inbox or repository. Not charged, price not final, not on sale. For comparison, managed triage inside bug bounty platforms is listed at EUR200 monthly in Hackrate's 2023 datasheet (10 reports yearly, one-year term). It is listed from US$299 monthly at Bugcrowd (read 9 Nov 2026: first year paid upfront, new customers, managed triage for a set number of first submissions), both inside a platform. Patchstack triages WordPress plugin reports for free; GitHub's private reporting form has rate limits and no triage or duplicate check we could find.
Confidentiality
Reports can hold an unpatched exploit. The plan: you decide what is forwarded, we keep reports only while a case is open and delete them when you close it, no report text goes to a model service that keeps inputs, and reproductions run only against your own code or a public release in a sandbox with no network access. We never test a live production site. None of this is built yet, and we cannot promise that a reported bug is real.
Join the waitlist (no payment, no details taken)
Pressing the button is counted as interest only. We take no name, email or repository link, so we cannot contact you; when there is something to try, it goes on this page.