Jekyll2026-08-07T16:39:39+00:00https://docs.bugcrowd.com/changelog.xmlBugcrowd user documentation2026-07-14T00:00:00+00:002026-07-14T00:00:00+00:00https://docs.bugcrowd.com/changelog/customers/savant-vista-public-beta<p>Savant Vista is now available in Public Beta for asset discovery and vulnerability scanning. The documentation suite has been updated to support onboarding and day-to-day use, including a new overview article covering core concepts and product scope, step-by-step how-to guides for estate discovery, vulnerability baseline setup, and launching an autonomous test, and updated detailed reference articles reflecting the current platform UI, asset model, and scan behavior.</p>

Savant Vista is now available in Public Beta for asset discovery and vulnerability scanning. The documentation suite has been updated to support onboarding and day-to-day use, including a new overview article covering core concepts and product scope, step-by-step how-to guides for estate discovery, vulnerability baseline setup, and launching an autonomous test, and updated detailed reference articles reflecting the current platform UI, asset model, and scan behavior.

2026-07-08T00:00:00+00:002026-07-08T00:00:00+00:00https://docs.bugcrowd.com/changelog/customers/vrt-update-119<p>Bugcrowd’s Vulnerability Rating Taxonomy (VRT) has been expanded to include Active Directory (AD) misconfigurations, Kerberos/SCCM abuse vectors, and server security misconfigurations (P1–P5). SSRF classifications have also been streamlined by replacing legacy categories with more granular SSRF metrics.</p>

Bugcrowd’s Vulnerability Rating Taxonomy (VRT) has been expanded to include Active Directory (AD) misconfigurations, Kerberos/SCCM abuse vectors, and server security misconfigurations (P1–P5). SSRF classifications have also been streamlined by replacing legacy categories with more granular SSRF metrics.

2026-05-18T00:00:00+00:002026-05-18T00:00:00+00:00https://docs.bugcrowd.com/changelog/researchers/verifying-your-identity<p>Identity verification (IDV) is now required for all researchers prior to submitting reports to Managed Bug Bounty (MBB) programs — both public and private (excluding on-demand MBBs). This change strengthens platform integrity by reducing high volumes of low-quality submissions originating from newly created or rotating accounts. Verification requires researchers to complete a live selfie capture via webcam and upload a valid government-issued ID (passport, identity card, or driver’s license) through an embedded portal accessible directly from Account Settings under the Identity Verification tab. Researchers who have previously completed IDV — including those verified for payments or background checks — do not need to re-verify. The process supports multi-nationality verification and allows up to five attempts before a support ticket is required. For more information, visit <a href="https://docs.bugcrowd.com/researchers/managing-account/account-settings/verifying-your-identity/">Verifying Your Identity</a>.</p>

Identity verification (IDV) is now required for all researchers prior to submitting reports to Managed Bug Bounty (MBB) programs — both public and private (excluding on-demand MBBs). This change strengthens platform integrity by reducing high volumes of low-quality submissions originating from newly created or rotating accounts. Verification requires researchers to complete a live selfie capture via webcam and upload a valid government-issued ID (passport, identity card, or driver’s license) through an embedded portal accessible directly from Account Settings under the Identity Verification tab. Researchers who have previously completed IDV — including those verified for payments or background checks — do not need to re-verify. The process supports multi-nationality verification and allows up to five attempts before a support ticket is required. For more information, visit Verifying Your Identity.

2026-05-14T00:00:00+00:002026-05-14T00:00:00+00:00https://docs.bugcrowd.com/changelog/customers/ip-restrictions<p>The IP Restrictions feature allows organization admins to restrict access to their organization based on IP address. By configuring an allowlist, you can ensure that only users connecting from approved IP addresses or CIDR ranges are able to access data within the organization.</p> <p>This setting is configured at the organization level and applies to all admin users associated with that organization.</p>

The IP Restrictions feature allows organization admins to restrict access to their organization based on IP address. By configuring an allowlist, you can ensure that only users connecting from approved IP addresses or CIDR ranges are able to access data within the organization.

2026-05-05T00:00:00+00:002026-05-05T00:00:00+00:00https://docs.bugcrowd.com/changelog/api/api-version-1.1.0<p>See the full <a href="https://docs.bugcrowd.com/api/1.1.0/">API Version 1.1.0 reference</a> for request/response details.</p> <h2 id="funding_pool-include-on-monetary-rewards"><code class="language-plaintext highlighter-rouge">funding_pool</code> include on monetary rewards</h2> <p>Added <code class="language-plaintext highlighter-rouge">funding_pool</code> as an includable relationship on the monetary reward endpoint. Use <code class="language-plaintext highlighter-rouge">include=funding_pool</code> to retrieve the funding pool associated with a monetary reward in a single request.</p> <h2 id="last_activity_feed_item_created_at-filter-on-the-submissions-index"><code class="language-plaintext highlighter-rouge">last_activity_feed_item_created_at</code> filter on the submissions index</h2> <p>Added <code class="language-plaintext highlighter-rouge">filter[last_activity_feed_item_created_at]</code> query parameter to the submissions index endpoint. This allows filtering submissions by the timestamp of their last activity feed item.</p> <h2 id="active_blocker-include-on-submissions"><code class="language-plaintext highlighter-rouge">active_blocker</code> include on submissions</h2> <p>Added <code class="language-plaintext highlighter-rouge">active_blocker</code> as an includable relationship on the submission endpoint. Use <code class="language-plaintext highlighter-rouge">include=active_blocker</code> to retrieve the active blocker for a submission in a single request.</p> <h2 id="active_researcher_request_response-include-on-submissions"><code class="language-plaintext highlighter-rouge">active_researcher_request_response</code> include on submissions</h2> <p>Added <code class="language-plaintext highlighter-rouge">active_researcher_request_response</code> as an includable relationship on the submission endpoint. Use <code class="language-plaintext highlighter-rouge">include=active_researcher_request_response</code> to retrieve the active researcher request response for a submission in a single request.</p> <h2 id="credential-bucket-endpoints">Credential bucket endpoints</h2> <p>Added credential bucket endpoints. Credential buckets allow programs to manage pools of credentials for researchers to use during testing.</p> <h2 id="credential-endpoints">Credential endpoints</h2> <p>Added credential endpoints. Credentials represent individual login credentials within a credential bucket that can be assigned to researchers.</p> <h2 id="post-submissionssearch-endpoint">POST <code class="language-plaintext highlighter-rouge">/submissions/search</code> endpoint</h2> <p>Added a POST endpoint for searching submissions with a JSON request body. Accepts filter, sort, page, include, and fields parameters in the body, avoiding URL length limitations for complex queries.</p>

See the full API Version 1.1.0 reference for request/response details.

2026-05-04T00:00:00+00:002026-05-04T00:00:00+00:00https://docs.bugcrowd.com/changelog/researchers/submissions-throttling<p>To reinforce platform accountability and ensure that high-quality, validated findings receive the attention and speed they deserve, Bugcrowd is introducing submission limits for Managed Bug Bounty (MBB) programs. Researchers will be limited to 5 simultaneous Open submissions (reports in the New or Triaged states), and submission limits will be restored as reports are moved out of Open states. Accounts with a proven track record of quality submissions and performance are exempt from these limits. For a complete breakdown of eligibility, substates, and tips for managing your account standing, please visit our <a href="https://docs.bugcrowd.com/researchers/reporting-managing-submissions/reporting-a-bug/submissions-limit/">documentation</a>.</p>

To reinforce platform accountability and ensure that high-quality, validated findings receive the attention and speed they deserve, Bugcrowd is introducing submission limits for Managed Bug Bounty (MBB) programs. Researchers will be limited to 5 simultaneous Open submissions (reports in the New or Triaged states), and submission limits will be restored as reports are moved out of Open states. Accounts with a proven track record of quality submissions and performance are exempt from these limits. For a complete breakdown of eligibility, substates, and tips for managing your account standing, please visit our documentation.

2026-05-01T00:00:00+00:002026-05-01T00:00:00+00:00https://docs.bugcrowd.com/changelog/customers/vrt-scope-rules<p>Engagement Briefs, the Submission form, and Security Inbox now support <strong>VRT Scope Rules</strong>. These rules allow you to set reminders and out-of-scope exclusions for VRT items on all or some of your targets or target groups.</p> <p>VRT Scope Rules are intended to set expectations with researchers at or before time of submission. Used judiciously, should reduce noise and triage times across your engagements.</p> <p>For full details, see the <a href="/customers/engagement-management/engagement-vrt-scope-rules/">VRT Scope Rules</a>.</p>

Engagement Briefs, the Submission form, and Security Inbox now support VRT Scope Rules. These rules allow you to set reminders and out-of-scope exclusions for VRT items on all or some of your targets or target groups.

2026-04-29T00:00:00+00:002026-04-29T00:00:00+00:00https://docs.bugcrowd.com/changelog/customers/cvss-v4<p>The CVSS Calculator now supports CVSS 4.0 alongside CVSS 3.1. Program administrators can enable CVSS 4.0 under Program Settings &gt; Submissions, after which all new submissions will default to the new version. Switching versions does not automatically update existing submissions. These must be reviewed manually via the Security Inbox, or updated in bulk through the API.</p> <p>For full details, see the <a href="https://docs.bugcrowd.com/customers/submission-management/cvss/">CVSS documentation</a>.</p>

The CVSS Calculator now supports CVSS 4.0 alongside CVSS 3.1. Program administrators can enable CVSS 4.0 under Program Settings &gt; Submissions, after which all new submissions will default to the new version. Switching versions does not automatically update existing submissions. These must be reviewed manually via the Security Inbox, or updated in bulk through the API.

2026-03-09T00:00:00+00:002026-03-09T00:00:00+00:00https://docs.bugcrowd.com/changelog/customers/vrt-update-118<p>Bugcrowd’s Vulnerability Rating Taxonomy (VRT) has been enhanced to support mappings to auto-suggest CVSS vectors for opt-in customers.</p>

Bugcrowd’s Vulnerability Rating Taxonomy (VRT) has been enhanced to support mappings to auto-suggest CVSS vectors for opt-in customers.

2026-02-02T00:00:00+00:002026-02-02T00:00:00+00:00https://docs.bugcrowd.com/changelog/customers/the-security-inbox<p>We are excited to announce the launch of the new Security Inbox. Designed as a high-performance command center, it offers streamlined triage workflows, powerful customization features, and deeper platform efficiencies to accelerate your time to remediation.</p> <h2 id="whats-new">What’s New</h2> <ul> <li><strong>Saved Views &amp; Pinning:</strong> Design your perfect workflow. Create, share, and pin custom filter sets as tabs for one-click access to your most critical work queues.</li> <li><strong>Focused View Layout:</strong> Maximize productivity with a split-screen interface. View full technical details side-by-side without losing your place (activities, brief, disclosures, etc.)</li> <li><strong>AI Triage Assistant:</strong> Leverage our secure, in-platform AI operational assistant to summarize complex findings, suggest remediation steps, and even generate Nuclei retest templates using natural language.</li> <li><strong>Automated Integration Triggers:</strong> Turn filters into actions. Link your Saved Views directly to Jira or other integrations to automate ticket creation based on your specific criteria.</li> </ul> <h2 id="improved-capabilities">Improved Capabilities</h2> <ul> <li><strong>Advanced Search &amp; Filtering:</strong> Find what you need in seconds. Search by Submission ID, Researcher, or Target with an enhanced filtering engine designed to help you focus on the vulnerabilities that matter most.</li> <li><strong>Modernized UI:</strong> Experience a refreshed, scannable design across the entire Inbox, specifically engineered to reduce cognitive load during high-volume triage sessions.</li> </ul> <h2 id="ready-to-dive-in">Ready to dive in?</h2> <p>To take full advantage of these new features and explore the updated workflows, please visit our <a href="https://docs.bugcrowd.com/customers/security-inbox/the-security-inbox/">Security Inbox Documentation.</a></p>

We are excited to announce the launch of the new Security Inbox. Designed as a high-performance command center, it offers streamlined triage workflows, powerful customization features, and deeper platform efficiencies to accelerate your time to remediation.