Adding an On-Demand Program

An On-Demand Program is a time-bound program runs for up to two weeks and relies on a monetary rewards structure to incentivize members of the researcher community to find security vulnerabilities in a defined set of assets and applications.

The information you provide in these steps will define the program scope and rewards. It will also help Bugcrowd identify the right skills and experience from the crowd to make sure maximum program value.

The steps to add an On-Demand program are:

1. Provide a program name
2. Set targets
3. Specify terms and conditions
4. Specify reward pool
5. Identify vulnerability concerns
6. Select the crowd
7. Add look and feel
8. Schedule program launch
9. Review details and submit

To add an On-Demand Program:

1. In the Select an engagement to launch window, click Start for On-Demand Program.

   

   The Step 1: Program Name page is displayed.

2. Provide a name for your program and click Next step. The Step 2: Set targets page is displayed. Also, the Grant created message is displayed.

3. Click Add target to add the target that must be tested. You can add multiple targets.

   On each page, you can click Save and complete later to save the information that you have filled and complete the remaining sections at a later time.

   The Add a target pop-up window is displayed.

4. Specify the following information:

   • Target Name (URL/Location): Select a target from the drop-down menu or specify a new target.

   • Category: If you select an existing target name, then the category is displayed by default. If you have specified a new target name, then select the required category:

     • Website
     • API
     • iOS
     • Android
     • IoT
     • Hardware
     • Other

   

5. Click Add. The target is added and the Target added to the program scope message is displayed.

   If you want to edit the target details, click the icon in the Actions column.

6. Click Next step. The Step 3: Terms and conditions page is displayed.

7. You can enable or disable the following options:

   • Use Bugcrowd’s Vulnerability Rating Taxonomy
   • Encourage disclosure of non-target issues
   • Safe harbor agreement
   • Co-ordinated disclosure

   To enable, move the slider to the right. To disable, move the slider to the left. By default, all the options are enabled.

8. Click Next step. The Step 4: Reward pool page is displayed.

9. In Bounty pool budget, specify the total reward pool for your program. The minimum value is $15,000.

10. Click Next step. The Identify Vulnerability Concerns page is displayed.

11. Specify the key security concerns you have and the important findings researchers must prioritize. This information helps Bugcrowd to select the best researchers for you.

12. Click Next step. The Step 6: Select Your Crowd page is displayed.

13. Specify the skills that the researcher must have. This will help Bugcrowd to select a security team (researchers) that match these requirements. The skills that you can specify are:

    • Researcher Activities: List the activities researcher will perform. For example, Website testing, API testing.
    • Asset Environments: Specify the environments the targets are running in.
    • Languages and Frameworks: List the programming languages, frameworks, and integrated libraries used by the targets.
    • Hosted and 3rd-party Applications and Services: Indicate whether the targets rely on hosted and 3rd party applications. For example, if the applications is running on a database, then specify MySQL.

    

14. Click Next step. The Step 4: Add look and feel page is displayed.

15. Specify the following information:

    • Upload a logo: Click Upload logo and specify a logo for your program.
    • Enter a background color for your logo: Provide a RGB hex value for the background color of the logo.
    • Tagline: Provide a tagline for your program.
    • Introduction: Provide a description for your program. This will be displayed as the first paragraph in your Program brief.

    After specifying the information, click Update preview for viewing your changes.

16. Click Next step. The Step 5: Schedule launch page is displayed.

17. In Preferred launch timeline, select an option to indicate when you want the program to start:

    • As soon as possible (default)
    • Within a month
    • More than a month

18. Click Next step. The Step 6: Review and submit page is displayed. Review the information that you have provided. In case you want to modify any details, click Edit and make the changes.

19. Click Submit. The Your program has been provisioned message is displayed.

    Bugcrowd will contact you to review and launch the program.

---