added info about Spam and informative reports for hacker report states

stacyspiva · stacyspiva · commit 94c1a2d93c10 · 2021-04-08T17:02:15.000-07:00
diff --git a/docs/hackers/report-states.md b/docs/hackers/report-states.md
@@ -30,7 +30,7 @@ These are the Closed report states:
 State | Detail | Change to Hacker Reputation
 ----- | ------ | ----------------------------
 Resolved | The report is valid and no further dialogue with the hacker is needed. | Increase +7
-Informative | The report contains useful information but doesn't warrant an immediate action or a fix. A program can consider providing an alternative risk assessment or other mitigating factors, and public disclosure is available with mutual agreement. | No change
+Informative | The report contains useful information but doesn't warrant immediate action or a fix. Examples of informative reports include:<ul><li>Notifications of broken links</li><li>The issue is not consistently reproducible</li><li>You report a subdomain takeover you encounter but did not execute it yourself</li></ul>A program can consider providing an alternative risk assessment or other mitigating factors. Public disclosure is available with mutual agreement. | No change
 Duplicate | This issue has already been reported. Programs can build trust by attributing the issue to its original discoverer and linking it to a previous report or including other details about its discovery. Public disclosure isn't available for this state. <br><br>*Note: If a hacker files a duplicate of a public report, their reputation will go down.* | If the hacker submits the original report:<br>*Resolved*: +2<br><br><br>*Not Applicable*: -5<br><br>*Informative*: 0
 Not Applicable | The report doesn't contain a valid issue and has no security implications. Security teams should describe why the report was invalid, so the hacker can improve their hacking skills. | Decrease -5
-Spam | The report is invalid because the hacker didn't describe a legitimate security vulnerability. You should notify HackerOne so additional restrictions can be applied to the hacker. | Decrease -10
+Spam | The report is invalid because a legitimate security vulnerability isn't described. The report may be incomprehensible, abusive and/or exhibit harassment. Reports that sell any sort of product or service will also be marked as Spam.| Decrease -10
