It’s not a question of if a report really is a dupe. This is going to happen constantly, proportionally to participation. The assertion is that secondary report

It’s not a question of if a report really is a dupe. This is going to happen constantly, proportionally to participation. The assertion is that secondary reports can have measurable value. Automatically paying dupes is untenable, but it seems like triage should handle dupes containing new information differently. If a vulnerability is sitting as a low priority and a dupe of the underlying vulnerability contains new information about the severity that gets it prioritized, it must have value.