Turn reports into issues

Open a Jira, Linear or GitHub issue for each disclosure report or incident, keep it updated, and mark the report fixed when the issue is done.

3 min readUpdated 5 October 2026

Connect an issue tracker and your engineers work on reports and incidents where they already plan their work. The conversation with the researcher stays in bynh.

What the tracker gets

• A report’s issue is titled [bynh #218] and the report’s title, with its summary, steps to reproduce, severity, asset, weakness, CVSS and a link back. It’s labelled bynh and security.
• An incident’s issue is titled “Incident:” and the incident’s title, with its latest update and what’s affected, labelled bynh and incident.
• Severity sets the priority: Critical is Highest in Jira and Urgent in Linear, then High, Medium and Low. Labels that don’t exist in Linear are left out, not created.
• The researcher’s email never goes to the tracker. Their files stay in bynh behind the link, unless you turn on Send the researcher’s files (Jira only).
• Without a linked issue, comment events send nothing.

Status stays in sync

bynh reads each linked issue’s status back every 5 minutes and shows it on the report or incident, such as “In Progress in Jira”, with when it was last synced.

With Mark the report fixed when the issue is done on (it starts on), a report moves to Fixed when its issue is done. The researcher sees the change and gets a note from you, as for any status change. Issues closed as won’t do, duplicate, not planned or canceled never mark a report fixed. Changes in bynh reach the tracker as comments; bynh doesn’t move the issue itself.

Open an issue by hand

On a report or an incident, choose Create issue. Pick the tracker, project, type and who to assign it to, and whether to include your team’s internal notes. Editors, admins and owners can do this. Unlink forgets the link in bynh; the issue stays in the tracker.

Turn Create an issue for every new report off to open issues only by hand. It starts on for Jira and off for Linear and GitHub.

Jira

1. 1

   Step 1: Connect Jira

   In Settings › Integrations, open Jira and choose Connect Jira. Sign in to Atlassian and allow access. bynh asks to read and write Jira issues, read Jira users (for the assignee picker), and stay connected (read:jira-work, write:jira-work, read:jira-user, offline_access). If you have several Jira sites, pick one.

2. 2

   Step 2: Pick the project

   Choose the project and issue type. The issue type mustn’t need extra required fields.

To use an API token instead, choose Use an API token instead: create a token at id.atlassian.com › Security, then enter your Jira site (like yourcompany.atlassian.net), your Atlassian email and the token. Issues are then created as that person. bynh keeps no Atlassian personal data: assignees go straight to Jira and aren’t stored. To revoke a connected app, open id.atlassian.com/manage-profile/apps.

Linear

1. 1

   Step 1: Connect Linear

   Choose Connect Linear and approve. bynh asks to read, create issues and create comments (read, issues:create, comments:create). Issues and comments are authored by the bynh app, not a person.

2. 2

   Step 2: Pick the team

   Choose the team new issues go to.

To use a key instead, open Settings › Security & access in Linear, create a personal API key (it starts with lin_api_) and paste it in bynh.

GitHub Issues

1. 1

   Step 1: Connect GitHub

   Choose Connect GitHub and install the bynh app on your account or organization, for the repositories you choose. It asks for Issues: read and write, Metadata: read, and Members: read (to confirm you’re an admin of the organization). You must own the account or be an organization admin.

2. 2

   Step 2: Pick the repository

   Choose a repository the app was given. Issues must be turned on for it.

To use a token instead, create a fine-grained token for one repository with Issues: read and write, and paste it in bynh (it starts with github_pat_). If an organization owner has to approve the app, connect again once they have. If the app is removed on GitHub, bynh turns the connection off at once and emails the workspace owners; reconnect to pick up again.