Customer Changelog

Customer > Integrations > ServiceNow URL

Improved

Customer > Microsoft Teams Workflow URLs

Added

Customer > Saved Searches UI Improvements

Improved

Customers > Pen Test Methodology Notes and Attachments

Improved

Customer > Submission Assignee Improvement

Improved

Customer Teams

Added

Customer > Submission Activity Feed Sort Improvement

Improved

New Insights Analytics

Added

Download Insights as CSV

Added

Customers > User Session Timeout Settings

Added

Customers > MFA Backup Codes

Added

Customers > VRT Update (1.14)

Improved

Customer > Platform > Image Zoom Enhancement

Added

Customer > Platform > Submission Form Enhancement

Improved

Customer > Embedded Submission Form > Require Email Address

Improved

Customer > Platform > Organization User Admin Role

Added

Customer > Platform > IP Allow List

Added

Customer > Integrations > ServiceNow Submission Description Field

Improved

Customer > Integrations > ServiceNow Security Incident Response

Added

Customer > Platform > Image Enhancements

Improved

Customers > Bugcrowd Microsoft Entra SSO App

Added

Customer > Submission Form Accessibility

Improved

Customer > VRT Update (1.13)

Improved

Customers > VRT Update (1.12)

Improved

Setting Up Single Sign-On Through SAML > OneLogin

Improved

Customers > VRT Update (1.11)

Improved

Customers > CVSS Update (3.1)

Improved

Customers > Viewing Attachments in Jira

Improved

Program Summary Page > Percentage Calculation Bar

Improved

Customers > Platform > Unlink Submission from External Incident

Improved

Customer > Pen Test Self Service Onboarding

Improved

Customers > Platform > Embedded Submission Form Font

Improved

Customer > Platform > Manage Team Enhancements

Improved

Customers > Platform > Collapse sidebar

Added

Customers > Platform > Markdown Toolbar

Added

Customers > Pen Test > Engagement Brief Changelog

Added

Customer > Platform > Submission Inbox Header UI Enhancements

Improved

Improved General Activity Notifications

Improved

• General Activity Notifications

Enhanced Industry versus Program Comparison Report

Improved

• Enhanced Industry Comparison Report at Program level

Platform > Submission ID added to the Submission Details

Added

Customer > Platform Navigation

Improved

Platform > Multi-tier Program Management

Added

• Multi-tier Program Management

Searching Transactions

Improved

• Searching Transactions

Pen Test Reports

Added

• Viewing Pen Test Report

Delete Credit Cards

Added

• Removing Credit Card Payment Method

Multifactor Authentication

Added

• Enforcing Multi-Factor Authentication (MFA) at Org level

Industry Versus Program Comparison Report

Added

• Industry Versus Program Report

Industry Versus Organization Comparison Report

Added

• Industry Versus Organization Report

Manage Low Threshold Pool Balance

Added

• Manage Low Threshold Pool Balance

Auto Retest Submission

Added

• Auto Retest Submission

Notifications

Improved

• Managing Notifications

Relinking Jira for a Submission

Added

• Relinking Jira Issue ID for a Submission

Microsoft Teams Integration

Added

• Microsoft Teams

New Program Dashboard

Improved

• Program Dashboard

Import Jira Issues into Crowdcontrol

Added

• Importing issues from Jira

Self-service Vulnerability Disclosure Programs

Added

• Self-service onboarding with a credit card purchasing for Vulnerability Disclosure Programs

Accounts Team Information in Welcome Center

Added

• Accounts team

Simplified Purchasing

Added

• Store credit cards on your account for purchasing

• Review bank details to initiate transfer

• Indicate need for Purchase Order within reward pool deposit

Multi-Organization Switching

Improved

• Switch between organizations

Submissions Trend and Periodic Submissions Reports

Added

• Generating Oraganization Level Submissions Trends Report

• Generating Organization Level Periodic Submissions Report

Updated with VRT 1.10

Added

• Introduced a variant for OAuth Accounting Squatting classified as a P4

• Secure Code Warrior developed a VRT mapping to their developer training

Improved

• Extended support for Automotive categorization, developed in collaboration with Stellantis.

• Downgraded all Flash-based entries to a rating of P5

• Improved existing remediation advice for a number of entries

• Simplified Weak Login Function entries with a baseline severity rating of P4

Improved Organization Level Navigation

Improved

• Organization Level Navigation Settings

Generating Organization Insight Report

Added

• Organization Insight Report

• Welcome Center to help you get started

Automatically Pushing Attachments into Jira

Added

• Include Attachment on Jira Issue Creation

Improved data fidelity and organization with Target Group

Added

• Better describe Targets with their new technology attributes and get Researchers there faster with a cleaner URL experience

• Detail a set of targets via Target Group descriptions

• Define a reward range per set of targets with recommendations presented when rewarding

Improved

• Documented days of operation relative to triage and researcher payments

Accounting Management

Added

• Self-serve to deposit into reward pool

• Organization-level reward pool to manage funds across one’s programs

• Transaction details across one’s organization

Task List

Added

• Task List to highlight and help you complete work

• Bounty Briefs support Image Embeds

• Provide feedback on documentation so we can continue to improve by clicking Give Feedback at the bottom of the page

New Documentation Site

Improved

• Design and Search at the same location https://docs.bugcrowd.com

Added

• Atom Feed

Inviting Researchers

Added

• Customers can invite researchers

Viewing NDA Compliance Status

Added

• Compliance Status on Researcher Page

Improved

• SSO Domain Validation no longer identifies Bugcrowd

• A submission’s disclosure policy is defined based on when the submission was submitted

Attack Surface Management Asset Inventory - Dashboards and other updates

Added

• New features in Attack Surface Management:Asset Inventory - Dashboards and other updates

New features in Attack Surface Management - Asset Inventory

Added

• New features in Attack Surface Management - Asset Inventory

Self-Service Program Initiation Now Available

Added

• Adding new engagement

Customer On-call Person

Added

• Customer On-call person

• On-Demand Programs require a Max and Min for reward levels

Changed

• On-Demand Programs require a Max and Min for reward levels

Slack Integration Notification for Blockers

Added

• Slack integration notification on Blockers

• Disclosure enabled by default for new programs

Improved

• Notifications for external researchers

• ADA compliance of external submission form

• Manage assignment and Custom fields when On-Demand programs are running

CrowdStream and Coordinated Disclosure

Added

• Setting CrowdStream activity feed visibility

• Managing disclosure request

• Priority Percentile to understand Researcher’s performance

IBM Resilient Integration

Added

• IBM Resilient

• Filter submissions using custom fields

Program Announcements

Added

• Program announcements

• Bugcrowd’s Slack Integration is now available in the Slack App Directory

• Bugcrowd’s Jira Integration is now available in the Atlassian Marketplace

Improved

• Additional search filters within Submission API

Filtering Customer Blockers

Added

• Submission Preset Queries

• Jira Issue Creation from New to Triaged

Customer Blockers

Added

• Create blockers

• Report researcher incidents

Improved

• Known issue sharing shows vulnerabilities across targets on multiple programs

Public Program Credential Support and Improved Target Management

Improved

• Public Programs can now support credentials

• Edit targets in program settings

Added

• Callout for customers when program is about to launch or has recently launched

Safe Harbor Configuration

Added

• Display customer’s Safe Harbor status within their brief

Image Embeds with controls

Added

• Customer Image Embed Settings

Retesting Update

Added

• Retesting platform support

Program Search Launched

Improved

• Renamed Additional Fields tab to Fields and Settings

• Renamed Known Issues tab to Import Issues

Integration Updates

Improved

• Jira authentication is now available via OAuth for both Cloud and Server

Added

• ServiceNow integration

Updating to VRT 1.7

Added

• Automative Security Misconfiguration category

• Sensitive Data Exposure > Weak Password Reset Implementation > Token Leakage via Host Header Poisoning as a new P2 variant, which is consistent with how this issue has been triaged by Bugcrowd’s Application Security Engineers so far.

• Two new P4’s related to 2FA Secret Management

Improved

• Remediation Advice links to latest OWASP Documentation

GitHub Integration

Added

• GitHub Integration

Comparison Operators for Dates

Improved

• Tokenized date search

Customer Avatar

Added

• Changing Your Profile Avatar

Bugcrowd mention

Improved

• Direct comment to user with triage team

Updated Standard Disclosure Terms

Improved

• Standard Disclosure Terms

Application Security Engineer Listed

Added

• Application Security Engineer listed

File Support Update

Improved

• Platform supports 100MB for all file uploads

Updating to VRT 1.6

Improved

• VRT 1.6

Add Reward Update

Added

• Add Reward Range

2FA Check Feature

Updating to VRT 1.5

Improved

• VRT 1.5

Enhancements Made to Jira Integrations

Added

• Automatically Push Submission Comments into Jira

• Map VRT to fields within Jira

• Map a Submission’s UUID to fields wthin Jira

Crowdcontrol Improves Adjusted Payment Workflow

Added

• Adjusting mistaken rewards workflow updated, Customers can send mail to support@bugcrowd.com.

Minor Tokenized Search Bugs Fixed

Fixed

• Duplicate query values no longer appear in tokenized search

• Tokenized search issues with dates

Improvements Made to Boost Submission Workflow Efficiency

Added

• Submission Blockers

• Use multiple sorting criteria for tokenized search

Improved

• Edit Submission Field

Improved SDLC and Remediation Support

Improved

• Jira Integration Supports Comments

• Downloadable CSV Report Includes Remediation Advice

Crowdcontrol Usability More Intuitive

Improved

• Edit multiple fields on a single submission at one time

Added

• Identify Bugcrowd employees in activity feeds with a new icon identifier

Hacker Education with Bugcrowd University

Added

• Bugcrowd University

Improved Platform Usability

Improved

• Tokenized search

• Known Issue Sharing displays Informational

• Program code can now have hyphens

• Push to Jira button now gives instant feedback

Fixed

• Sorting researchers within Crowdcontrol by last submitted

Advanced Crowdcontrol UX

Added

• Unique Avatars - distinct default avatars to easily identify users. (Customer

• Hover over avatar to show a user’s email address.

• Highlight recently updated on the Programs page

• Indication on customer’s programs page which programs are demos.

• Leveraging program or user images for unfurling.

Improved

• Use Crowdcontrol on the go, now with a responsive navigation bar.

• Change states without needing to dismiss thanks to notifications shown below the customer state dropdown.

Enhanced Security Tracking Capability

Added

• Customer Security Event Log

• Researcher Security Event Log

Multiple Jira Project Support & Flexible Jira Sync

Improved

• Jira Advanced Field Configuration

Added

• Jira Multi-Project Support

Updating to VRT 1.4

Added

• VRT v1.4 is shipped

Enhance Program Metrics

Fixed

• Transaction Times within insights take into account skipped states

• Validation Time within the Bounty Brief takes into account submissions that have not been validated yet

Improved

• Bounty average payouts only include first to find, P1-4 payouts

Heightened Platform Security and Usability

Added

• Remove timeout, instead using re-authentication prompts.

• Interactive Session Management UI

Improved

• Added SSO indicators for authentications within the Session Management interface

Crowdcontrol Increases Visibility

Added

• Known Issue Sharing

• bugcrowd.com/changelog

New Crowdcontrol Enhancements Add Improved Platform Efficiencies

Added

• Search by Custom Fields with the Submission Search Bar

• Pick-list support within Jira integration

• Search result number count when using the Submission Search Bar

• Insights filter toggle - offering a clean display for sharing data on TVs

Improved

• Tailored experience with new notification settings

• Page design refreshes on the Rewards page

Improved Program Performance Tracking and Platform Efficiency

Improved

• Program performance metric to Program Page (Time to Validation)

• VRT Categories to Tokenized Search [Customer]

• Customers can “read” credentials if enabled on their program

Enhanced Security & Improved Functionality Offer Seamless Usability

Added

• Platform Security – Implemented CSP protections

• Drag and drop to sort the order of targets on your bounty brief

• Filter by the Submitted Date (Tokenized Search)

New Submission Search Bar and Filtering

Added

• Search bar has been launched within Crowcontrol

Improved

• Known issue import no longer requires submitted_at to be set, defaulting to the current time.

• Text search within Crowdcontrol is now more accurate in filtering for exactly what you search for, no longer trying to handle misspellings.

Improved Efficiency with CVSS and Notifications

Added

• CVSS scores get backfilled based on VRT after enabled on a program

• Easy to track email notifications now with threading grouped by submissions are delivered as a thread within email clients

Added CVSS Calculator

Added

• Organizations can manage submission severity with CVSS v3

Introducing VRT 1.3

Improved

• VRT v1.3 is shipped

New Notification Management and Downloadable Data

Added

• View and manage your notifications all from the new notifications page.

• Download CSV of reward data from Crowdcontrol.

New Embedded Submission Form

Added

• Use the Embedded Submission Form integration to integrate a submission form from your own website rather than through Bugcrowd.

Improved Notifications

Improved

• Viewing unread notifications automatically marks them as read

Seamless Crowdcontrol Quick Search

Added

• Enable syntax highlighting in your fenced code blocks when writing or commenting on a submission.

• Use Quick Search to find exactly what you’re looking for in Crowdcontrol.

VRT 1.2, Improved Functionality, and New Integration

Added

• Attach a file to comments within Crowdcontrol.

• Import known issues found in Qualys WAS scans into Crowdcontrol

Improved

• v1.2 of the VRT is available

• Custom fields now support up to 2048 characters.

Slack Integration

Added

• Slack integration is now available

VRT Goes Open Source

Added

• VRT gem is now open sourced

Enhanced Reporting

Improved

• Rewards are now listed in the order in which they were rewarded.

Added

• CSV exports of submissions now include information about the target (name and category) and the source of the submission.

Simplified Workflow and Improved Filtering

Added

• source filters are now available in Insights.

• Switching between programs now takes you to the same page in the selected program.

Improved Clarity and Workflow

Added

• Researchers can now upload an attachment to a comment

• New and Triaged submissions can be auto-assigned to a team member.

Print a Submission

Added

• Individual submissions can now be printed within Crowdcontrol

Improved Security and Transparency

Improved

• Password entropy validation will be performed on any page where a password can be changed.

• Public program response metrics for a program can now be viewed without logging in to the platform.

• P5 submissions can now be viewed and filtered in Insights.