Crowdcontrol makes it easy to communicate clear reward ranges directly on your bounty brief, based on the technical severity of the vulnerability.
Set Prior to Program Launch: Reward ranges may only be set by the Owner, Admin, or Analyst prior to the program going live. Once the program is live, please submit a support ticket through the Bugcrowd Support Portal to get assistance with editing the reward range.
To set up bounty reward ranges on your program brief follow the steps below:
-
Navigate to the Settings page. Navigating to the settings page will bring you to the program brief tab.
-
Scroll to Program Rewards.
-
Set a Maximum Advertised Payout. This maximum payout will be visible to the researcher upon invite to a private program. Providing researchers insight into the maximum payout is helpful information to help them decide whether they’d like to participate in your program and ensures those who accept the invitation, will be actively testing.
-
Set reward ranges for each technical severity.
There are a few options when setting reward ranges:
- You can set a minimum and maximum for a specific severity by filling in both the Low Reward and High Reward field.
The reward range will be displayed in the program brief as seen on the image below.
- You can set a range up to a specific amount for a specific severity by filling in the High Reward field and leaving the Low Reward field empty.
The reward range will be displayed in the program brief as seen on the image below.
- You can set a range to start at a specific amount for a specific severity by filling in the Low Reward field and leaving the High Reward field empty.
The reward range will be displayed in the program brief as seen on the image below.
- Or, if you wish to not pay for a specified vulnerability severity, leave the field blank.
If left blank, a notification below the reward range will highlight which severity levels will not receive rewards. Researchers will still receive the appropriate kudos points for these submissions.
On-demand Programs: For On-demand programs, you must specify both Low Reward (minimum) and High Reward (maximum) for a priority level. When the program closes, the reward pool is divided based on a calculation. Hence, the minimum and maximum values sets the limit on how the reward pool is divided.
-
Update the Program.
