Changelog

Customers > Customer > Integrations > ServiceNow URL

Improved

Customers > Customer > Microsoft Teams Workflow URLs

Added

Customers > Customer > Saved Searches UI Improvements

Improved

Customers > Customers > Pen Test Methodology Notes and Attachments

Improved

Customers > Customer > Submission Assignee Improvement

Improved

Customers > Customer Teams

Added

Customers > Customer > Submission Activity Feed Sort Improvement

Improved

Customers > New Insights Analytics

Added

Customers > Download Insights as CSV

Added

API > New API version released 2024-08-15

Added

• Add engagement relationship to submission creation endpoint

Customers > Customers > User Session Timeout Settings

Added

Customers > Customers > MFA Backup Codes

Added

Researchers > Researchers > VRT Update (1.14)

Improved

Customers > Customers > VRT Update (1.14)

Improved

API > New API version released 2024-07-11

Added

• Add authentication log endpoint

• Add authorization logs endpoint

• Add disclosure request endpoint

Researchers > Researcher > Platform > Featured Collections

Added

Researchers > Researcher > Platform > Image Zoom Enhancement

Added

Customers > Customer > Platform > Image Zoom Enhancement

Added

Customers > Customer > Platform > Submission Form Enhancement

Improved

Customers > Customer > Embedded Submission Form > Require Email Address

Improved

Customers > Customer > Platform > Organization User Admin Role

Added

Customers > Customer > Platform > IP Allow List

Added

Customers > Customer > Integrations > ServiceNow Submission Description Field

Improved

Customers > Customer > Integrations > ServiceNow Security Incident Response

Added

Researchers > Researcher > Platform > Image Enhancements

Improved

Customers > Customer > Platform > Image Enhancements

Improved

Customers > Customers > Bugcrowd Microsoft Entra SSO App

Added

Customers > Customer > Submission Form Accessibility

Improved

Researchers > Researcher > VRT Update (1.13)

Improved

Customers > Customer > VRT Update (1.13)

Improved

API > New API version released 2024-03-27

Added

• Add activities.event as includable resource to submission endpoint

• Add filter by engagement to submission endpoint

• Add submissions as includable resource to engagement endpoint

API > New API version released 2024-02-12

Added

• Release engagement resource endpoint

API > New API version released 2024-02-09

Added

• Add an engagement resource endpoint

API > New API version released 2024-01-11

Added

• Add network to target category attribute values

• Add actor submission actitivy

Researchers > Researcher > VRT Update (1.12)

Improved

Customers > Customers > VRT Update (1.12)

Improved

Customers > Setting Up Single Sign-On Through SAML > OneLogin

Improved

Researchers > Researchers > VRT Update (1.11)

Improved

Customers > Customers > VRT Update (1.11)

Improved

Customers > Customers > CVSS Update (3.1)

Improved

Customers > Customers > Viewing Attachments in Jira

Improved

Researchers > Pen Test > Percentage Calculation Bar

Improved

Customers > Program Summary Page > Percentage Calculation Bar

Improved

Customers > Customers > Platform > Unlink Submission from External Incident

Improved

Customers > Customer > Pen Test Self Service Onboarding

Improved

Researchers > Researchers > Platform > Monitoring and Filtering Bugcrowd and Customer Activity

Added

Customers > Customers > Platform > Embedded Submission Form Font

Improved

Researchers > Researchers > Platform > Finding a Program

Improved

API > Customer > Platform > Delete Outgoing Webhook

Improved

• Deleting Outgoing Webhooks

Customers > Customer > Platform > Manage Team Enhancements

Improved

Customers > Customers > Platform > Collapse sidebar

Added

Researchers > Researchers > Platform > Request a Response

Added

Researchers > Researchers > Platform > Markdown Toolbar

Added

Customers > Customers > Platform > Markdown Toolbar

Added

Researchers > Researchers > Engagement states

Improved

• Engagement states

Researchers > Researchers > Pen Test > Engagement Brief Changelog

Added

Customers > Customers > Pen Test > Engagement Brief Changelog

Added

Customers > Customer > Platform > Submission Inbox Header UI Enhancements

Improved

Customers > Improved General Activity Notifications

Improved

• General Activity Notifications

Customers > Enhanced Industry versus Program Comparison Report

Improved

• Enhanced Industry Comparison Report at Program level

Researchers > Platform > Submission ID added to the Submission Details

Added

Customers > Platform > Submission ID added to the Submission Details

Added

Researchers > Researchers > Platform Navigation

Improved

Customers > Customer > Platform Navigation

Improved

Customers > Platform > Multi-tier Program Management

Added

• Multi-tier Program Management

Researchers > 2FA setup, usage, and backup key management

Improved

• Using Two-Factor Authentication

Researchers > Payment Threshold Amount

Added

• Payment Threshold Amount

• Frequently Asked Questions

Customers > Searching Transactions

Improved

• Searching Transactions

Customers > Pen Test Reports

Added

• Viewing Pen Test Report

Customers > Delete Credit Cards

Added

• Removing Credit Card Payment Method

API > View Team Member API Keys

Added

• Admins can now view the API keys of their team members

Customers > Multifactor Authentication

Added

• Enforcing Multi-Factor Authentication (MFA) at Org level

Customers > Industry Versus Program Comparison Report

Added

• Industry Versus Program Report

Customers > Industry Versus Organization Comparison Report

Added

• Industry Versus Organization Report

API > Deprecation of Generic Header Usage for Legacy (v3) API

Deprecated

• Generic accept header not supported for legacy (v3) API

API > Support for Generic Accept Headers on Current Version

Added

• The current API version will now accept Generic Accept Header

Customers > Manage Low Threshold Pool Balance

Added

• Manage Low Threshold Pool Balance

API > Manage Team Member API Keys

Added

• Manage Team Members API Keys

API > New Feature for Reacting to Bugcrowd Events

Added

• Webhook integration

Customers > Auto Retest Submission

Added

• Auto Retest Submission

Researchers > Improved Bug Reporting

Improved

• Reporting A Bug

Customers > Notifications

Improved

• Managing Notifications

Customers > Relinking Jira for a Submission

Added

• Relinking Jira Issue ID for a Submission

Customers > Microsoft Teams Integration

Added

• Microsoft Teams

API > API code examples

Added

• API code examples

API > Auth token must be marked legacy to use the legacy (v3) API

Changed

• Auth token must be marked legacy to use the legacy (v3) API

API > New token deprecation warning for the legacy (v3) API

Deprecated

• The legacy (v3) API will now 404 if used with a new auth token

API > New field and button to copy raw request body from webhook delivery page

Added

• New field and button to copy raw request body from webhook delivery page

API > New API version released 2021-10-28

Added

• Add visibility_scope attribute to comment

• Add create comment endpoint POST /comments

• Add external_issue relationship to submission

• Add event based webhooks

• Add filter and sort by latest activity to submission index

• Add jira to submission source attribute values

• Add download_url to FileAttachment

Changed

• Change wont_fix to informational

Deprecated

• Deprecate s3_signed_url on FileAttachment

Removed

• Remove invited-asc and invited-desc sort options from programs index

Fixed

• Add maximum page offset error

• Fix data type error when value is not an object

• Fixed schema error for nullable fields

• Fix relationship default order

• Fix submission state filter when value is new

Security

• Change related submission access

• Remove researcher_email from submission

• Scope included targets to user program access

Customers > New Program Dashboard

Improved

• Program Dashboard

Customers > Import Jira Issues into Crowdcontrol

Added

• Importing issues from Jira

Customers > Self-service Vulnerability Disclosure Programs

Added

• Self-service onboarding with a credit card purchasing for Vulnerability Disclosure Programs

Customers > Accounts Team Information in Welcome Center

Added

• Accounts team

Customers > Simplified Purchasing

Added

• Store credit cards on your account for purchasing

• Review bank details to initiate transfer

• Indicate need for Purchase Order within reward pool deposit

Customers > Multi-Organization Switching

Improved

• Switch between organizations

Customers > Submissions Trend and Periodic Submissions Reports

Added

• Generating Oraganization Level Submissions Trends Report

• Generating Organization Level Periodic Submissions Report

Platform > Updated with VRT 1.10

Added

• Introduced a variant for OAuth Accounting Squatting classified as a P4

• Secure Code Warrior developed a VRT mapping to their developer training

Improved

• Extended support for Automotive categorization, developed in collaboration with Stellantis.

• Downgraded all Flash-based entries to a rating of P5

• Improved existing remediation advice for a number of entries

• Simplified Weak Login Function entries with a baseline severity rating of P4

Customers > Improved Organization Level Navigation

Improved

• Organization Level Navigation Settings

Customers > Generating Organization Insight Report

Added

• Organization Insight Report

• Welcome Center to help you get started

API > Bugfix for state filter on /submissions

Fixed

• Filtering for submissions in new state does not return any

Customers > Automatically Pushing Attachments into Jira

Added

• Include Attachment on Jira Issue Creation

API > New API version released 2021-01-25

Added

• Add transition timestamps for submission resource

• Add options to programs fields parameter

• Add options to programs include parameter

• Add options to submissions fields parameter

• Add options to submissions include parameter

Removed

• Remove invalid top-level parameters

• Remove additional properties from POST /claim_tickets

• Remove program_groups from program

• Remove reward_range from submissions fields parameter

• Remove submission from targets fields parameter

Changed

• Change submission relationship on POST /claim_tickets to has_many

• Change error message for POST /monetary_rewards

• Change order of include lists

Security

• Scope programs relationship for included organization resources

API > Increased expiration time for file_attachments in all versions

Changed

• Increased expiration time of s3_signed_url attribute for file_attachments

Customers > Improved data fidelity and organization with Target Group

Added

• Better describe Targets with their new technology attributes and get Researchers there faster with a cleaner URL experience

• Detail a set of targets via Target Group descriptions

• Define a reward range per set of targets with recommendations presented when rewarding

Improved

• Documented days of operation relative to triage and researcher payments

Customers > Accounting Management

Added

• Self-serve to deposit into reward pool

• Organization-level reward pool to manage funds across one’s programs

• Transaction details across one’s organization

API > New API with flexible versioning

Added

• New API

• View active API keys provisioned across your team

Changed

• More detailed query parameter documentation (from swagger UI to redoc)

Customers > Task List

Added

• Task List to highlight and help you complete work

• Bounty Briefs support Image Embeds

• Provide feedback on documentation so we can continue to improve by clicking Give Feedback at the bottom of the page

Researchers > Just for You - Program Recommendations

Added

• Viewing just for you programs

Researchers > Discover Programs

Added

• Discovering Programs

Researchers > 2FA Backup Codes in Platform

Added

• Enabling backup codes for 2FA configuration

Customers > New Documentation Site

Improved

• Design and Search at the same location https://docs.bugcrowd.com

Added

• Atom Feed

API > API Token usage

Added

• Visibility into usage of API tokens across the team

Customers > Inviting Researchers

Added

• Customers can invite researchers

Customers > Viewing NDA Compliance Status

Added

• Compliance Status on Researcher Page

Improved

• SSO Domain Validation no longer identifies Bugcrowd

• A submission’s disclosure policy is defined based on when the submission was submitted

Researchers > Payments Through Bank Transfer

Added

• Setting Up Bank Transfer payment method

Customers > Attack Surface Management Asset Inventory - Dashboards and other updates

Added

• New features in Attack Surface Management:Asset Inventory - Dashboards and other updates

Customers > New features in Attack Surface Management - Asset Inventory

Added

• New features in Attack Surface Management - Asset Inventory

Customers > Self-Service Program Initiation Now Available

Added

• Adding new engagement

Customers > Customer On-call Person

Added

• Customer On-call person

• On-Demand Programs require a Max and Min for reward levels

Changed

• On-Demand Programs require a Max and Min for reward levels

Customers > Slack Integration Notification for Blockers

Added

• Slack integration notification on Blockers

• Disclosure enabled by default for new programs

Improved

• Notifications for external researchers

• ADA compliance of external submission form

• Manage assignment and Custom fields when On-Demand programs are running

Customers > CrowdStream and Coordinated Disclosure

Added

• Setting CrowdStream activity feed visibility

• Managing disclosure request

• Priority Percentile to understand Researcher’s performance

Researchers > Achievement Badges

Added

• Researcher Achievement Badges

• Priority Percentile now available within your profile

Researchers > CrowdStream and Coordinated Disclosure

Added

• Viewing activity feed in CrowdStream

• Disclosing submission report summary

Customers > IBM Resilient Integration

Added

• IBM Resilient

• Filter submissions using custom fields

Researchers > Program Feedback when Ignoring or Hiding

Added

• Ignoring invitation or hiding program

Changed

• Researcher Avatar visible to submitted programs

Customers > Program Announcements

Added

• Program announcements

• Bugcrowd’s Slack Integration is now available in the Slack App Directory

• Bugcrowd’s Jira Integration is now available in the Atlassian Marketplace

Improved

• Additional search filters within Submission API

Researchers > Submission Retesting

Added

• Retesting Submissions

• View Payments and Points in Filtered Submission Results

Customers > Filtering Customer Blockers

Added

• Submission Preset Queries

• Jira Issue Creation from New to Triaged

Customers > Customer Blockers

Added

• Create blockers

• Report researcher incidents

Improved

• Known issue sharing shows vulnerabilities across targets on multiple programs

Researchers > Certificates

Added

• Adding certifications

Researchers > Safe Harbor Search

Added

• Researchers can filter by program’s safe harbor status within program search

Researchers > Researcher Collaboration

Added

• Researcher Collaboration

Customers > Public Program Credential Support and Improved Target Management

Improved

• Public Programs can now support credentials

• Edit targets in program settings

Added

• Callout for customers when program is about to launch or has recently launched

Researchers > Public Program Credential Support and Improved Target Management

Improved

• Public Programs can now support credentials

Customers > Safe Harbor Configuration

Added

• Display customer’s Safe Harbor status within their brief

Researchers > Image Embeds

Added

• Image Embeds in Submissions and Comments

Customers > Image Embeds with controls

Added

• Customer Image Embed Settings

Customers > Retesting Update

Added

• Retesting platform support

Customers > Program Search Launched

Improved

• Renamed Additional Fields tab to Fields and Settings

• Renamed Known Issues tab to Import Issues

Researchers > Program Search Launched

Added

• Program Search

Customers > Integration Updates

Improved

• Jira authentication is now available via OAuth for both Cloud and Server

Added

• ServiceNow integration

Platform > Updating to VRT 1.7

Added

• Automative Security Misconfiguration category

• Sensitive Data Exposure > Weak Password Reset Implementation > Token Leakage via Host Header Poisoning as a new P2 variant, which is consistent with how this issue has been triaged by Bugcrowd’s Application Security Engineers so far.

• Two new P4’s related to 2FA Secret Management

Improved

• Remediation Advice links to latest OWASP Documentation

Customers > GitHub Integration

Added

• GitHub Integration

Platform > Comparison Operators for Dates

Improved

• Tokenized date search

Customers > Customer Avatar

Added

• Changing Your Profile Avatar

Customers > Bugcrowd mention

Improved

• Direct comment to user with triage team

Customers > Updated Standard Disclosure Terms

Improved

• Standard Disclosure Terms

Customers > Application Security Engineer Listed

Added

• Application Security Engineer listed

Researchers > Payments Update

Added

• Payments

Platform > File Support Update

Improved

• Platform supports 100MB for all file uploads

Platform > Updating to VRT 1.6

Improved

• VRT 1.6

Customers > Add Reward Update

Added

• Add Reward Range

Researchers > Point Reward System Better Aligns Expectations and Acknowledges Researchers for Their Hard Work

Added

• Won’t Fix submissions are rewarded points

• Payments

Fixed

• Email notifications on updates for Researchers

Customers > 2FA Check Feature

Platform > Updating to VRT 1.5

Improved

• VRT 1.5

Customers > Enhancements Made to Jira Integrations

Added

• Automatically Push Submission Comments into Jira

• Map VRT to fields within Jira

• Map a Submission’s UUID to fields wthin Jira

Researchers > Crowdcontrol Improves Adjusted Payment Workflow

Added

• Adjusting mistaken rewards workflow updated

Customers > Crowdcontrol Improves Adjusted Payment Workflow

Added

• Adjusting mistaken rewards workflow updated, Customers can send mail to support@bugcrowd.com.

Customers > Minor Tokenized Search Bugs Fixed

Fixed

• Duplicate query values no longer appear in tokenized search

• Tokenized search issues with dates

Researchers > Added Platform Usability and Preference Control

Added

• Pending Invitations filter

• Pause Pending Payments

Customers > Improvements Made to Boost Submission Workflow Efficiency

Added

• Submission Blockers

• Use multiple sorting criteria for tokenized search

Improved

• Edit Submission Field

Researchers > Callout for submissions that are blocked

Improved

• Submission Blockers

Customers > Improved SDLC and Remediation Support

Improved

• Jira Integration Supports Comments

• Downloadable CSV Report Includes Remediation Advice

Customers > Crowdcontrol Usability More Intuitive

Improved

• Edit multiple fields on a single submission at one time

Added

• Identify Bugcrowd employees in activity feeds with a new icon identifier

Researchers > Improved identification of Bugcrowd

Improved

• Identify Bugcrowd employees in activity feeds with a new icon identifier

Platform > Hacker Education with Bugcrowd University

Added

• Bugcrowd University

Customers > Improved Platform Usability

Improved

• Tokenized search

• Known Issue Sharing displays Informational

• Program code can now have hyphens

• Push to Jira button now gives instant feedback

Fixed

• Sorting researchers within Crowdcontrol by last submitted

Researchers > Improved Submission Search

Improved

• Tokenized search

Researchers > Advanced Crowdcontrol UX

Added

• Unique Avatars

• updated label on the Programs page, to highlight recently updated programs.

• Bugcrowd ninja forwarding now includes the to email address to allow sub-domains.

• Quick links panel in Researcher dashboard

• Leveraging program or user images for unfurling

Improved

• Use Crowdcontrol on the go, now with a responsive navigation bar.

• Notifications show below the customer state dropdown, so you can quickly change states, without needing to dismiss.

Customers > Advanced Crowdcontrol UX

Added

• Unique Avatars - distinct default avatars to easily identify users. (Customer

• Hover over avatar to show a user’s email address.

• Highlight recently updated on the Programs page

• Indication on customer’s programs page which programs are demos.

• Leveraging program or user images for unfurling.

Improved

• Use Crowdcontrol on the go, now with a responsive navigation bar.

• Change states without needing to dismiss thanks to notifications shown below the customer state dropdown.

Platform > Enhanced Security Tracking Capability

Added

• Customer Security Event Log

• Researcher Security Event Log

Customers > Multiple Jira Project Support & Flexible Jira Sync

Improved

• Jira Advanced Field Configuration

Added

• Jira Multi-Project Support

Platform > Updating to VRT 1.4

Added

• VRT v1.4 is shipped

Customers > Enhance Program Metrics

Fixed

• Transaction Times within insights take into account skipped states

• Validation Time within the Bounty Brief takes into account submissions that have not been validated yet

Improved

• Bounty average payouts only include first to find, P1-4 payouts

Researchers > Heightened Platform Security and Usability

Added

• Remove timeout, instead using re-authentication prompts.

• Interactive Session Management UI

Customers > Heightened Platform Security and Usability

Added

• Remove timeout, instead using re-authentication prompts.

• Interactive Session Management UI

Improved

• Added SSO indicators for authentications within the Session Management interface

Customers > Crowdcontrol Increases Visibility

Added

• Known Issue Sharing

• bugcrowd.com/changelog

Researchers > Crowdcontrol Increases Visibility

Added

• Known Issue Sharing

• bugcrowd.com/changelog

Customers > New Crowdcontrol Enhancements Add Improved Platform Efficiencies

Added

• Search by Custom Fields with the Submission Search Bar

• Pick-list support within Jira integration

• Search result number count when using the Submission Search Bar

• Insights filter toggle - offering a clean display for sharing data on TVs

Improved

• Tailored experience with new notification settings

• Page design refreshes on the Rewards page

Researchers > New Crowdcontrol Enhancements Add Improved Platform Efficiencies

Added

• Search by Custom Fields with the Submission Search Bar

• Search result number count when using the Submission Search Bar

• Insights filter toggle - offering a clean display for sharing data on TVs

Improved

• Page design refreshes on the ID Verification and Payment Method Configuration pages

Researchers > Improved Program Performance Tracking and Platform Efficiency

Added

• Program performance metric to Program Page (Time to Validation)

• VRT Categories to Tokenized Search

Customers > Improved Program Performance Tracking and Platform Efficiency

Improved

• Program performance metric to Program Page (Time to Validation)

• VRT Categories to Tokenized Search [Customer]

• Customers can “read” credentials if enabled on their program

Customers > Enhanced Security & Improved Functionality Offer Seamless Usability

Added

• Platform Security – Implemented CSP protections

• Drag and drop to sort the order of targets on your bounty brief

• Filter by the Submitted Date (Tokenized Search)

Researchers > Enhanced Security & Improved Functionality Offer Seamless Usability

Added

• Platform Security – Implemented CSP protections

• Filter by the Submitted Date (Tokenized Search)

• Filter by the date a submission was awarded points (Tokenized Search)

• Filter by the date a submission was awarded payment (Tokenized Search)

Customers > New Submission Search Bar and Filtering

Added

• Search bar has been launched within Crowcontrol

Improved

• Known issue import no longer requires submitted_at to be set, defaulting to the current time.

• Text search within Crowdcontrol is now more accurate in filtering for exactly what you search for, no longer trying to handle misspellings.

Researchers > New Submission Search Bar and Filtering

Added

• Advanced submission filtering is live

Improved

• Text search within Crowdcontrol is now more accurate in filtering for exactly what you search for, no longer trying to handle misspellings.

Customers > Improved Efficiency with CVSS and Notifications

Added

• CVSS scores get backfilled based on VRT after enabled on a program

• Easy to track email notifications now with threading grouped by submissions are delivered as a thread within email clients

Customers > Added CVSS Calculator

Added

• Organizations can manage submission severity with CVSS v3

Platform > Introducing VRT 1.3

Improved

• VRT v1.3 is shipped

Customers > New Notification Management and Downloadable Data

Added

• View and manage your notifications all from the new notifications page.

• Download CSV of reward data from Crowdcontrol.

Customers > New Embedded Submission Form

Added

• Use the Embedded Submission Form integration to integrate a submission form from your own website rather than through Bugcrowd.

Customers > Improved Notifications

Improved

• Viewing unread notifications automatically marks them as read

Customers > Seamless Crowdcontrol Quick Search

Added

• Enable syntax highlighting in your fenced code blocks when writing or commenting on a submission.

• Use Quick Search to find exactly what you’re looking for in Crowdcontrol.

API > Advanced API Documentation

Added

• New API docs are available.

• created_at DateTime within the Comment Object

Customers > VRT 1.2, Improved Functionality, and New Integration

Added

• Attach a file to comments within Crowdcontrol.

• Import known issues found in Qualys WAS scans into Crowdcontrol

Improved

• v1.2 of the VRT is available

• Custom fields now support up to 2048 characters.

Customers > Slack Integration

Added

• Slack integration is now available

Platform > VRT Goes Open Source

Added

• VRT gem is now open sourced

Customers > Enhanced Reporting

Improved

• Rewards are now listed in the order in which they were rewarded.

Added

• CSV exports of submissions now include information about the target (name and category) and the source of the submission.

Customers > Simplified Workflow and Improved Filtering

Added

• source filters are now available in Insights.

• Switching between programs now takes you to the same page in the selected program.

Customers > Improved Clarity and Workflow

Added

• Researchers can now upload an attachment to a comment

• New and Triaged submissions can be auto-assigned to a team member.

Customers > Print a Submission

Added

• Individual submissions can now be printed within Crowdcontrol

Customers > Improved Security and Transparency

Improved

• Password entropy validation will be performed on any page where a password can be changed.

• Public program response metrics for a program can now be viewed without logging in to the platform.

• P5 submissions can now be viewed and filtered in Insights.