Martijn Russchen commented on issue #9390 at GitLab.org / GitLab

Martijn Russchen
2019-03-11T17:38:57Z

Based on my experience building integrations with other tools. A few things to consider:

Most programs in H1 use the HackerOne triage services. This means that initial triage will usually be done on the H1 platform. From there, all our integrations have a simple button in the UI to create an issue in the issue tracker linked. If you're going to pull reports from H1 via the API, you can consider only pulling reports that are in the "triaged" state.

We learned that larger teams need the ability to optionally select a different "project" to escalate their issues towards. We've implemented this in the H1 UI by allowing the person to escalate the report to select a project before clicking the submit button. This is an optional feature.

People like to see the severity on an H1 report to be reflected in their issue tracker as well. For Jira, we support mapping between H1 severity (which is based on CVSS) and their priority mapping. We could do something similar with GitLab.

People like to sync over attachments to the issue tracker. This avoids some manual copy/pasting, as this usually contains a lot of valuable information.

Sometimes you want to link a triage H1 report to an existing issue in your issue tracker. Allowing people to link those together is valuable.