As the tittle says, I had three. SSRF reports go to NASA's VPR before they were all closed as informative under P5. Which, while unfortunate, had the reports triaged in under 2 days. Which is always a quality I as a research greatly appreciate from programs and vendors.

I have spent the last 4 months interacting with the Apple security response team (SRT). They have been incredibly thorough with their evaluations, informative closes are almost always accompanied by a detailed explanation as to why it is not applicable. They are fast with triage and will usually move on your report within 48 hours. The surface however, is increasingly hardened as automated security research has massively accelerated the speed at which it used to take. As such, the most critical note when submitting to Apple, always, and I mean always, prove the impact, weaponize the exploit, demonstrate the chain. If any part reads as theoretical, it will not strengthen the case for the report.

Triage overall left me relatively disappointed, but by equal measures, relived. I reported a remote code execution to this program in May, the H1 analyst team reviewed and downgraded the severity from critical to high on account of double-counting the UI:R component, in the CVSS. Two weeks after the report was closed as informative quote: "The team has confirmed that the current behavior is working as expected given the trust model of the application." After thorough, and repeated follow up and technical rebuttal the company corrected their initial decision and awarded a bounty payout. The timeline on this report was May 23 → July 9, a whole 47 days, with 27 of those days, it sitting as Informative. Ultimately their turnaround and decision to award the bounty was appreciated and I will continue to engage with them where appropriate. However, to any new researchers on H1, do not pursue this program before you have the signal to request mediation, as without it, you will be entirely at the mercy of the program.