"""外部白帽子漏洞赏金运营 (Bug Bounty / VDP operations).

The domain that turns "a white-hat emailed us" into a governed,
auditable, budgeted lifecycle:

  intake (paste the mail, AI-parse it) → assign a business owner →
  owner confirms validity + remediation ETA → security finalises the
  severity → reply to the researcher from a template → pay the bounty
  → report on budget burn, remediation SLA and per-team attribution.

Design notes worth knowing before touching this code:

* **Helix never emails the researcher.** The correspondence lives in the
  security team's own mailbox thread; Helix renders the reply from a
  template and the operator copies it out. Every rendered reply is
  logged as a report event so the record of what we told the researcher
  is complete even though the transport is out of band.
* **Three orthogonal axes**, never collapsed into one status column:
  triage (``status``), remediation (``remediation_status``) and money
  (``payment_status``). A valid finding can be fixed but unpaid, or paid
  but unfixed; a single enum cannot express that and every report that
  matters (budget burn vs fix-rate vs false-positive rate) needs them
  separated. See ``constants.py`` for the machines.
* **No banking data, ever.** Payout tracking records amount / date /
  reference / operator. Account numbers stay in the mail thread.
* **The researcher's identity is IT-only.** The assigned business owner
  sees the technical content and nothing else — see
  ``serializers.serialize_report(include_sensitive=...)``.
"""