Communicating with Researchers

Why It Matters

Researchers judge programs on communication speed and clarity more than bounty amounts. A program that acknowledges reports promptly and provides transparent status updates earns trust — and trust brings higher-quality submissions. Centralized message threads keep every communication auditable for SOC 2 evidence, so no report falls through the email cracks.

Message Threads

Every report has a dedicated message thread. This is where all communication between your team and the researcher happens — no side-channel emails or Slack DMs to lose track of.

Each message has one of two visibility modes:

Mode	Visible To	Use Case
External	Staff and researcher	Asking for reproduction steps, sharing status updates, coordinating fixes
Internal	Staff only	Engineering notes, triage discussion, severity debate

Toggle the Internal switch before sending to keep notes off the researcher-facing view. Internal messages appear with a yellow background and an “Internal” badge in the thread so your team can distinguish them at a glance.

Messages support Markdown formatting — bold, lists, code blocks, and links all render correctly. All messages are timestamped and attributed to the sender. Once sent, messages cannot be edited or deleted. This immutability is intentional: it preserves the audit trail that SOC 2 auditors expect.

Sending a Message

1. Open a report from the Triage Board
2. Navigate to the Messages tab
3. Compose your message in the text box
4. Toggle Internal if this is a staff-only note
5. Click Send

External messages trigger an email to the researcher with a magic link back to their portal. The researcher can reply from the portal, and their response appears in the same thread in real time.

Some status transitions — such as acknowledging a report, requesting clarification, or marking it Validated — also send an automatic email to the researcher. These automatic emails use fixed, built-in templates that ship with Kit and are not editable in the app. To control your own outbound wording, use the Message Templates that pre-fill the reply composer (see below).

Draft Responses

A reply you are not ready to send yet can be saved as a draft. Click Save as draft in the composer instead of Send to researcher. Nothing is emailed, and nothing appears in the researcher’s portal.

The draft sits at the bottom of the Conversation tab, above the composer, marked Not sent:

Action	What it does
Send to researcher	Emails the reply and adds it to the thread
Edit	Reopens the draft for changes
Discard draft	Deletes it — this cannot be undone

A report holds one draft at a time, so the whole team sees the same pending reply rather than writing competing versions. While a draft is waiting, the composer is replaced by a pointer to it.

The card shows who wrote the draft and who last edited it. If two people edit at once, the second save is refused rather than silently overwriting the first — you are told who changed it and when.

When the researcher replies first

If the researcher sends a message after the draft was written, Kit blocks the send and warns you: “The researcher replied after this draft was written.” This is the common way a draft goes wrong — a reply asking for reproduction steps the researcher has just supplied.

Read their message first. Send anyway only becomes available once you have actually opened the newer reply.

AI-written drafts

An AI agent connected over MCP can save a draft but, by default, cannot email a researcher at all. Agents draft; people send.

The card labels where the text came from — Drafted by AI, or Drafted by AI · edited by Jane once someone has changed it. That label is for your team only; nothing marks the copy the researcher receives.

Message Templates

Message Templates seed the reply composer when your team manually replies to a researcher from a report’s Messages tab. They do not change the automatic system emails (acknowledgment, status-change notifications, magic link, and so on) — those are rendered from fixed, built-in templates.

When you compose a reply and pick a reply intent (Acknowledge, Ask for info, Confirm valid, Decline, or Bounty news), Kit resolves the matching template and uses it to pre-fill your draft (and to seed the AI-assisted draft, which falls back to the template text if the AI is unavailable). You stay in control: nothing is sent until you review and click Send.

Navigate to VDP > Message Templates to customize them. Kit uses a 3-tier template hierarchy:

1. System defaults — Built-in templates that ship with every program. Read-only.
2. Account overrides — Your customized versions that apply to all programs on your account.
3. Program-level overrides — Templates scoped to a specific program.

The most specific template wins. If you create an account-level override for Report Acknowledged, it replaces the system default for every program on your account — for the purpose of pre-filling the reply composer, not the automatic acknowledgment email.

Templates use Liquid syntax ({{ variable_name }}). Click the Preview button to see how a template renders with sample data before saving.

Template Types

Kit defines 11 template types. Five are currently wired to the reply composer — picking the corresponding intent pre-fills your reply with that template:

Template	Reply intent (composer)
Report Acknowledged	Acknowledge
Clarification Requested	Ask for info
Report Validated	Confirm valid
Report Dismissed	Decline
Bounty Approved	Bounty news

The remaining types — Report Resolved, Fix Verification Requested, Payout Sent, Escalation, Appeal Received, and Magic Link — exist as template types but are not currently wired to any send path or composer intent, so editing them has no visible effect yet.

Available Liquid Variables

Use these variables in your template subject lines and bodies:

Variable	Description
{{ researcher_name }}	Researcher’s display name or handle
{{ report_id }}	Prefixed report ID (e.g., rpt_abc123)
{{ report_title }}	Title of the vulnerability report
{{ program_name }}	Your VDP program name
{{ severity }}	Assessed severity tier (e.g., High, Critical)
{{ bounty_amount }}	Approved bounty in formatted currency (e.g., $500.00)
{{ portal_link }}	Magic-link URL to the researcher’s portal
{{ sla_hours }}	Configured SLA hours for this severity level
{{ dismissal_reason }}	Reason code from the dismissal (e.g., Out of Scope, Duplicate)

For example, a customized Report Acknowledged template might look like:

Hi {{ researcher_name }},

Thank you for submitting a report to {{ program_name }}. Your report ({{ report_id }}) has been received and our team will review it within {{ sla_hours }} hours.

You can track your report status at any time:
{{ portal_link }}

Email Branding

All researcher-facing emails are automatically branded with your account’s identity. This builds trust with reporters by matching the emails to your security portal’s look and feel.

What’s Branded

Element	How It Works
Sender name	Emails arrive from your program name (e.g. “Acme VDP”) instead of the platform name
Logo	Your account logo appears in the email header
Accent color	CTA buttons use your brand’s primary color
Footer	Shows your program name alongside a small “Sent via Kit” attribution

Configuration

Email branding inherits from your account-wide appearance settings. Navigate to Account Settings > Appearance to configure your logo and primary color. The same branding applies to your career portal, security portal, and now all researcher notification emails.

No per-template branding configuration is needed. Once you set up your account branding, all 11 researcher email types use it automatically.

If no logo is uploaded, emails display your program name as text. If no branding is configured at all, emails use the default platform styling.

Slack Notifications

Kit posts one card per report in your VDP channel and threads everything else underneath it, so your team can follow a report without checking the dashboard — and without the channel filling up. Slack Report Threads covers the model in full; this is the short version.

Setup

1. Navigate to Account Settings > Integrations > Slack and connect your workspace
2. Route the New vulnerability report submitted purpose (or the All VDP notifications catch-all) to the channel your security team reads

Where Each Event Lands

Event	Where it shows up
New report submitted	Posts the report’s card in your VDP channel — this is the thread root
Any status change	A reply in that report’s thread, and the card is redrawn
SLA breached	A reply in the thread
Bounty approved	A reply in the thread — plus a standalone post if you routed Bounty approved to a different channel
Disbursement completed	A reply in the thread — same separate-channel rule as above
Appeal received	A reply in the thread
Assignment or re-assignment	No reply; the card’s Assignee field is redrawn

Asking KitBot About Reports

Once Slack notifications are flowing, you can mention @KitBot in your VDP channel to ask questions without opening Kit. Where you mention it — and what you ask — determines what it answers (see Using @KitBot in Slack for the full picture):

• In a report’s thread — because the thread root is the report, KitBot resolves it with no guessing and answers about that specific report: status, summary, timeline, SLA state, duplicate checks, severity context, and how the bounty compares to your matrix.
• Top-level in the channel — KitBot answers program-wide questions: SLA breaches, open report counts, and metrics.

Example Prompts

@KitBot is this report closed?
@KitBot summarize the timeline and current SLA state
@KitBot any SLA breaches right now?

In a report’s thread you can also ask KitBot to save what it wrote as an internal note:

@KitBot summarise this discussion as an internal note
@KitBot record the decision: duplicate of the March report

The note is filed under your name and is staff-only — KitBot has no tool that can send anything to a researcher. See Slack Report Threads.

Everything else is read-only. KitBot cannot triage, assign, dismiss, message researchers, or approve bounties — for those actions it links you to the report in Kit.

To get answers, your Slack profile email must match your Kit account email, and your account needs an active VDP program. If the emails don’t match, KitBot sends you a private note explaining how to fix it instead of sharing report data.

Escalation

When a report is assessed as Critical or Super Critical — or any severity you mark as escalating — Kit posts an escalation line in that report’s Slack thread.

The surface that actually interrupts a human is your on-call rotation: when a report at an escalating severity is validated, Kit alerts the current responder by Slack DM or email, and raises a PagerDuty incident if you’ve connected one. There is no escalation mailing list — Triage Settings let you choose which severities escalate and set a default assignee, but not who to email.

To choose which severities trigger an escalation, go to VDP > Program Settings > Triage and set your escalation severities.

Quick Checklist

• Customize the Report Acknowledged reply template so the composer pre-fills your program’s tone
• Set up the Report Dismissed reply template to explain common dismissal reasons
• Configure Slack integration so your team sees new reports in real time
• Mention @KitBot in a report’s Slack thread to test report Q&A
• Set up an on-call rotation so Critical and Super Critical findings actually page someone — the Slack thread alone won’t
• Use Internal messages for engineering coordination; External for researcher-facing communication
• Save a draft instead of sending when a reply needs a second pair of eyes
• Decide whether AI agents may email researchers directly — the default is drafts only

Next Steps

• Slack Report Threads — what the report card shows, what posts a thread reply, and why restricted reports never appear
• The Researcher Portal — what researchers see, how they submit, and how they appeal
• Bounties and Payouts — approving bounties, tax documents, and the financial ledger