- Overview
- Why Credentials Matter
- Credential Types
- Email Credentials (“Forwarding Emails”)
- Text Credentials (Plain-Text)
- Multi-Factor Authentication (MFA)
- Setting Up Credentials for Your Program
- How Researchers Claim Credentials
- Assigning Credential Bucket to Engagement
- Adding More Credentials Mid-Engagement
- Recycling, Archiving, Deleting Credentials
Overview
The Bugcrowd platform gives your security program a secure, scalable way to provide researchers with the credentials they need to test your applications. Rather than managing credential distribution manually, the platform automates assignment, tracks usage, and keeps sensitive account details out of email threads.
This guide walks you through credential types, how to set them up, and how researchers claim and use them — so your program can start testing faster with less overhead.
Why Credentials Matter
Credentials allow researchers to authenticate into your applications and test with a real user identity. Without login access, testing is limited to the outer surface of your application. Many of the most impactful vulnerability classes (broken access control, privilege escalation, insecure direct object references) require an authenticated session to discover.
Providing dedicated test accounts also protects your production users: researchers attack accounts that belong to the test environment, not real customers.
Common scenarios where multiple accounts are needed per researcher:
- Testing whether one user can access another user’s data or permissions (horizontal privilege escalation)
- Testing whether a standard user can access admin-level functionality (vertical privilege escalation)
- Testing cross-tenant isolation — e.g., whether a user in Org A can access data belonging to Org B
Credential Types
Bugcrowd supports two types of credential buckets. Choose the type that matches how your test accounts are structured.
Email Credentials (“Forwarding Emails”)
Best for applications that require a real, working inbox for account registration or email-based verification steps (e.g., activation links, password resets, OTP codes).
How it works: Bugcrowd generates anonymized email addresses in the format verb-noun-####@bugcrowdninja.com. You use these addresses to create test accounts in your environment. When a researcher claims a credential, their Bugcrowd inbox is linked to that address, and any email your application sends to it is automatically forwarded to the researcher in real time.
Example: Email credential bucket showing available forwarding addresses
Note: Forwarding email addresses are permanently tied to the researcher who claims them. They cannot be reassigned to a different researcher once claimed.
Text Credentials (Plain-Text)
Best for accounts that don’t require email verification, such as username/password pairs, API keys, or accounts with additional structured data such as account numbers or verification codes.
These credentials are entered directly into the platform as structured text. Researchers can view them after claiming, without any email forwarding required.
Note: If your accounts require both a login and additional account-specific information (e.g., a KYC-style account number), please work with your Bugcrowd Customer Engagement Manager to structure these credentials correctly before uploading.
Multi-Factor Authentication (MFA)
If your application enforces MFA, Bugcrowd can support the following second-factor methods for researcher test accounts:
| MFA Method | Notes |
|---|---|
| Email OTP | Automatically handled via forwarding email credentials — codes are relayed to the researcher’s inbox. |
| SMS / Phone OTP | Bugcrowd can provision dedicated phone numbers for test accounts. Please raise this with your Customer Engagement Manager. |
| TOTP Authenticator | Supported via 1Password TOTP. Please share the TOTP seed with your Customer Engagement Manager when providing credentials. Note: Microsoft Authenticator is not supported. |
Setting Up Credentials for Your Program
Bugcrowd organizes credentials into “buckets” — each bucket corresponds to a set of accounts for a specific application or engagement.
Navigate to Program Settings > Credential Buckets to access your bucket management area:
Program Settings navigation — select “Credential buckets” from the left sidebar
From the Credential Buckets page you can see all existing buckets and create new ones:
Credential Buckets overview — shows assigned engagements, type, and credential counts per bucket
When creating a new bucket, fill in the bucket name and description, and check “This bucket is ready” only when you are ready for researchers to start using this credential bucket.
Bucket details form — name, description, and ready status
The credential settings panel lets you select:
- Credential type (Email or Text) - (see section above about the different types)
Credential settings — credential type
- Auto-assign quantity: how many credentials are automatically allocated when a researcher requests access
- Low-balance alert threshold: Program Owner receives an email notification when available credentials drop below this number
Credential settings — auto-assign quantity, and low-balance alert threshold
How Researchers Claim Credentials
Once your credential bucket is live, researchers access their credentials directly from the engagement brief — no manual distribution required.
| Step | Description |
|---|---|
| Request from Brief | Researchers click “Claim Credentials” at the bottom of the engagement brief. The platform automatically assigns the next available credential set from the bucket. |
| Receive Credentials | For text credentials, the researcher sees their assigned username/password and any additional fields immediately. For email credentials, they receive a @bugcrowdninja.com inbox linked to their account. |
| Access Email Forwarding | For email-based accounts, any email your application sends to the assigned address — activation links, OTP codes, password resets — is forwarded in real time to the researcher’s Bugcrowd inbox. |
Assigning Credential Bucket to Engagement
You can assign a credential bucket by selecting an existing bucket and searching for an engagement to assign the bucket to.
Credential Buckets overview — select a bucket to manage its engagement assignments
Bucket detail — search for and assign engagements to this credential bucket
Adding More Credentials Mid-Engagement
If your program grows or additional researchers join, you can add more credentials to an existing bucket. For text buckets, you can add more entries to the bucket by entering the values and clicking on Add Credential
Text credentials — add credential form
For Email credentials bucket, you can enter number of new credentials to generate:
Email credentials — generate new credentials form
Recycling, Archiving, Deleting Credentials
To make a credential available again, use Recycle — this unassigns it from the researcher and returns it to the available pool.
If you no longer need a credential, you can Delete it from the bucket entirely.
To act on multiple credentials at once, select them using the checkboxes and apply Recycle or Delete in bulk.
Avoid archiving credentials. Archived credentials permanently block the bucket from being deleted, even if none are actively in use.
