Finding Labels and Status - Cantina Documentation

Understanding finding statuses and labels

Finding Labels

Labels are user-made tags which can be assigned to a finding. Each Cantina Code repository can have its own custom tags, and whether a user can create or modify a tag depends on the engagement and security review type. Common labels include:

Potentially Duplicate: Used when a finding may match another submission and still needs confirmation.
Escalated: Used in competitions when a researcher disagrees with a judge’s decision and escalates the finding.

Finding Status

Below is the list of finding statuses used on Cantina. Bug bounty programs use a focused subset with bounty-specific payout rules. See Bug Bounty Finding Statuses.

Status	Description
New	Once a finding is submitted by the security researcher, it will be labelled as new by default.
In Review	The finding has been triaged and is now waiting on the client input. The outcome will appear on the finding when that review is complete.
Disputed	On the occasion where the competition client disagrees with the judging decision of a finding, they would change the status of the finding to disputed while providing reasoning to the change.
Rejected	Upon review, if the finding does not fit the criteria within the competitive scoring schema, the judge will list the finding as rejected.
Duplicate	Marked when another researcher already reported the same underlying issue. In competitions, duplicates are rewarded; in bug bounties they are not (see Bug Bounty Finding Statuses).
Confirmed	When the finding is valid, it will be labelled as confirmed and be awarded based on the competition prize pool.
Acknowledged	After a finding is confirmed by the judge, the competition sponsor will have to acknowledge and double confirm the issue.
Fixed	After a finding is acknowledged, the sponsor marks it Fixed once the issue has been remediated. This status tracks findings that have already been fixed.
Spam	When a finding is marked as spam, it typically refers to the issue reported being irrelevant, low-quality, automated and inappropriate. Both the judge and the sponsor can mark this status for findings.
Withdrawn	If the researcher submits an issue and decides to withdraw it for any reason, the finding will be labelled as “Withdrawn”.