bugcrowd-reporting

BUGCROWD REPORTING — Program-Specific Tactics

Companion to the generic report-writing skill. Use when working specifically on Bugcrowd submissions where VRT mapping, OOS-clause rebuttals, or per-program target selection matter.

This skill encodes patterns that apply specifically to Bugcrowd's submission flow. For the generic per-platform templates (HackerOne / Bugcrowd / Intigriti / Immunefi report bodies), use the report-writing skill. For the 7-Question Gate before deciding to report at all, use triage-validation.

---

1. VRT Category Selection — Search & Fallback Strategy

Bugcrowd's submission form requires a single VRT (Vulnerability Rating Taxonomy) selection. The dropdown's default severity is bound to the chosen node — pick wrong and the form auto-suggests P4 when the actual impact is P3 or P2.

1.1 Search hierarchy (try in order, pick the highest-severity match that still describes the bug)

For any finding, search the VRT dropdown with these terms in this order:

1. The bug's primary class — e.g., IDOR, XSS, SSRF, auth bypass, 2FA bypass
2. The data category exposed — e.g., PII, sensitive data exposure, disclosure of secrets
3. The control bypassed — e.g., broken access control, authentication bypass
4. The endpoint type — e.g., no rate limiting on form > login, no rate limiting on form > change password
5. The generic parent node — e.g., Server Security Misconfiguration > Other, Broken Access Control > Other

1.2 Pick the highest-severity match that still accurately describes the bug

Never select a VRT that misrepresents the bug just to get a higher default severity. Triagers will reassign and may flag the misrepresentation. The discipline is: pick the most specific accurate VRT, then use §2 (Manual Severity Override) if the default is wrong.

1.3 Common mappings worth knowing

Finding type	First-choice VRT	Fallback
ATO via missing 2FA on password change	Broken Authentication & Session Management → Second Factor Authentication (2FA/MFA) → Bypass	Broken Auth → Authentication Bypass → Other
Password oracle without rate limit	Broken Authentication & Session Management → Authentication Bypass → Other	Server Security Misconfiguration → No Rate Limiting on Form → Login
GraphQL introspection / APQ allowlist bypass	Server Security Misconfiguration → Other (justify in body)	Broken Access Control → Other
Username → real name PII enumeration	Sensitive Data Exposure → PII Leakage / Disclosure of Secrets → Non-Corporate User	Broken Access Control → Other
State desync on security-sensitive action	Application-Level DoS → Other (with state-desync framing)	Server Security Misconfiguration → Other
Email/SMS pumping on auth-flow endpoint	Server Security Misconfiguration → No Rate Limiting on Form → Email-Triggering / SMS-Triggering	Server Security Misconfiguration → No Rate Limiting on Action
Token brute-force (email-change OTP, password reset)	Broken Authentication → Authentication Bypass → Other	Server Security Misconfiguration → No Rate Limiting on Action