A product security engineer managing a bug bounty programme receives dozens of vulnerability reports weekly and needs to consistently triage them for validity, deduplicate overlapping reports, assign CVSS-calibrated severity scores, and draft researcher-facing responses that are legally safe, technically accurate, and relationship-preserving. Volume and consistency are the core problems.