Use a short, fixed set of outcomes: valid, duplicate, informational, out of scope, not reproduced, and incident. Define each in one sentence in your policy, and tell the reporter which label applied and why. Clear labels reduce arguments and make your numbers meaningful.
Why labels matter
Without labels, every closed case is a custom story. With them, you can count what came in, explain decisions consistently and compare quarter to quarter. CISA's federal directive uses a similar idea: its metrics separate the total number of reports from reports determined to be valid, meaning in scope and not a false positive. Its sample risk ranking also includes labels such as not applicable, for out of scope, negligible or not enough information, and incident, for a compromise that already happened.
A practical set
| Outcome | Definition |
|---|---|
| Valid | In scope, reproduced, and a real security weakness |
| Duplicate | Same root cause as a case you already hold or fixed |
| Informational | True observation with no meaningful security impact today |
| Out of scope | Concerns an asset or finding type excluded by policy |
| Not reproduced | You could not confirm it after reasonable effort and questions |
| Incident | Shows an attack or access already happened, handled by incident response |
Add a seventh label only if you need it. Too many labels slow people down.
Rules for using them
Say why. A bare "closed as informational" feels dismissive. Add one sentence: "This header is missing, but no sensitive operation depends on it."
Define duplicate carefully. Duplicates are about root cause, not wording. Two reports of the same flaw in different endpoints may share one fix but could deserve separate credit. Our post on two researchers reporting the same bug covers this.
Do not use not reproduced as a shortcut. Use it only after asking for details.
Allow reopening. If the reporter adds evidence, reopen the case without fuss.
Keep valid separate from severe. A valid low severity bug is still valid.
Link outcomes to rewards and credit
If you run a bounty, publish what each outcome means for payment. If you run only a policy, say what each outcome means for credit. People accept an unfavorable decision more easily when the rule was visible before they sent the report.
Count them
At the end of each quarter, count reports by outcome. A high out of scope share suggests your scope page is unclear. A high informational share suggests your report template should list excluded findings. A high not reproduced share suggests your report form should ask for versions and steps. See fields for a tracking record for where to store the outcome.
Where Safeguard fits
When a valid case turns out to involve a dependency, Safeguard's reachability analysis helps you decide whether your own code calls the vulnerable path, and a free scan lets you check your projects without setup.
Quick check
Is informational the same as invalid?
No. Informational means the observation is true but low impact. Invalid would mean the claim is false.
Do we have to publish our labels?
You do not have to, but publishing them makes decisions more predictable for reporters.
Sources
Last reviewed: 19 October 2026.
