Bugcrowd reporting

--- name: bugcrowd-reporting description: "Bugcrowd-specific reporting tactics that complement report writing: VRT category search-and-fallback strategy when no exact match exists, manual severity override when VRT defaults underestimate the impact, severity-request paragraph as the first body section, OOS-clause rebuttal templates (rate limiting on auth-flow endpoints, debug-info framing, user enumeration involving sensitive PII, theoretical-issue counter), chained-finding cross-reference patterns, target selection forQA versus production programs, researcher-side best practices (Bugcrowdninja email alias, account state restoration, friendly-tester approach). Use when filing a Bugcrowd submission, when the VRT default appears incorrect, when a triager closes a report as OOS or downgrades its severity, when chaining linked submissions, or when the scope distinguishes between production andQA . Pairs with report-writing and triage-validation." --- # BUGCROWD REPORTING : Program-Specific Tactics > Companion to the genericreport-writing skill . Use when working specifically on Bugcrowd submissions where VRT mapping, OOS-clause rebuttals, or per-program target selection matter. Thisskill encodes patterns that apply specifically to Bugcrowd’s submission flow. For the generic per-platform templates (HackerOne / Bugcrowd / Intigriti / Immunefi report bodies), use thereport-writing skill . For the 7-Question Gate before deciding to report at all, usetriage-validation . --- ## 1. VRT Category Selection : Search & Fallback Strategy Bugcrowd’s submission form requires a single VRT (Vulnerability Rating Taxonomy) selection. The dropdown’s default severity is tied to the selected node:if you choose the wrong one, the form automatically suggests a lower priority (often P4) even when the actual impact is P3 or P2. > Note: VRT default severities are not fixed constants. Bugcrowd revises the VRT schema across versions, and individual programs can remap defaults via their own priority configuration. The P-values shown in the examples below (e.g., “No Rate Limiting on Form → Login” defaulting to P4) represent the typical baseline at the time of writing:always check the severity that the current form actually auto-suggests for this program rather than assuming the value listed here. ### 1.1 Search hierarchy (try in order; choose the highest-severity match that still describes the bug) For any finding, search the VRT dropdown using these terms in this order: 1. The bug’s primary class : e.g.,IDOR ,XSS ,SSRF ,auth bypass ,2FA bypass 2. The data category exposed : e.g.,PII ,sensitive data exposure ,disclosure of secrets 3. The control bypassed : e.g.,broken access control ,authentication bypass 4. The endpoint type : e.g.,no rate limiting on form > login ,no rate limiting on form > change password 5. The generic parent node : e.g.,Server Security Misconfiguration > Other ,Broken Access Control > Other ### 1.2 Choose the match with the highest severity that still accurately describes the bug Never select a VRT that misrepresents the bug just to get a higher default severity. Triagers will reassign the issue and may flag the misrepresentation. The rule is: choose the most specific accurate VRT, then use §2 (Manual Severity Override) if the default is incorrect. ### 1.3 Common mappings worth knowing | Finding type | First-choice VRT | Fallback | |---|---|---| | ATO via missing 2FA on password change | Broken Authentication & Session Management → Second Factor Authentication (2FA/MFA) → Bypass | Broken Auth → Authentication Bypass → Other | | Password oracle without rate limit | Broken Authentication & Session Management → Authentication Bypass → Other | Server Security Misconfiguration → No Rate Limiting on Form → Login | | GraphQL introspection / APQ allowlist bypass | Server Security Misconfiguration → Other (justify in body) | Broken Access Control → Other | | Username → real name PII enumeration | Sensitive Data Exposure → PII Leakage / Disclosure of Secrets → Non-Corporate User | Broken Access Control → Other | | State desync on security-sensitive action | Application-Level DoS → Other (with state-desync framing) | Server Security Misconfiguration → Other | | Email/SMS pumping on auth-flow endpoint | Serve