Link the two reports, confirm they describe the same flaw, treat the second as a signal that others may know about it, and reassess your timeline. Credit both people according to your written policy. The CERT Guide to CVD advises verifying independence, since rediscovery happens, and considering faster remediation.
Why duplicates matter
A duplicate is not just paperwork. If a second person found the same flaw without talking to the first, the flaw is findable. Someone with less friendly intentions may find it too. The CERT Guide to Coordinated Vulnerability Disclosure, in its vendor scenarios, says to verify independence, reassess the embargo, consider speeding remediation and disclosure, and make sure bounty rules cover duplicates.
Steps
- Compare the reports. Same root cause, same component, same fix? Or two symptoms of two bugs? Decide by reading code, not by title.
- Link them in your tracker under one case with two reporters.
- Check independence. Ask each, politely, whether they discussed it with anyone. Two reports a day apart from one company may be the same team.
- Look at dates. Note when each report arrived. Your policy decides how credit works, and dates make that decision easy to explain.
- Reassess the clock. If your plan was a slow release, ask whether a second discoverer changes that.
- Tell both reporters that there is another report, without sharing the other person's details.
- Credit according to policy. Many projects credit all independent finders; others credit the first. Whichever you choose, say it in the policy.
Policy questions to settle before the first duplicate
| Question | Why it matters |
|---|---|
| Who is credited if two people report it? | Avoids arguments |
| Does a duplicate qualify for any reward you offer? | Sets expectations |
| Do you tell the second reporter about the first? | Respect for privacy |
| What counts as a duplicate? | Same root cause or same symptom |
Edge cases
- The second report adds a new attack path. Treat it as part of the same case, but update the impact and severity.
- The second report arrives after a fix is released. Reply with the version that fixes it and the advisory link, and credit per policy.
- The second report is public. Move straight to your public awareness steps. See the post on what to do when a vulnerability goes public early.
Quick check
Is a duplicate report less important?
No. It is evidence that more than one person can find the issue, which should raise urgency.
Should we share the first reporter's name with the second?
Not without permission. Say that a report already exists and keep details private.
Safeguard's zero-day discovery and dependency scanning can help you notice when a weakness you were told about elsewhere also exists in a library you ship. The free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
