Jekyll2026-07-15T07:59:00+00:00https://docs.bugcrowd.com/feed/changelogs/customer.xmlBugcrowd user documentation2026-07-14T00:00:00+00:002026-07-14T00:00:00+00:00https://docs.bugcrowd.com/changelog/customers/savant-vista-public-beta<p>Savant Vista is now available in Public Beta for asset discovery and vulnerability scanning. The documentation suite has been updated to support onboarding and day-to-day use, including a new overview article covering core concepts and product scope, step-by-step how-to guides for estate discovery, vulnerability baseline setup, and launching an autonomous test, and updated detailed reference articles reflecting the current platform UI, asset model, and scan behavior.</p>

Savant Vista is now available in Public Beta for asset discovery and vulnerability scanning. The documentation suite has been updated to support onboarding and day-to-day use, including a new overview article covering core concepts and product scope, step-by-step how-to guides for estate discovery, vulnerability baseline setup, and launching an autonomous test, and updated detailed reference articles reflecting the current platform UI, asset model, and scan behavior.

2026-07-08T00:00:00+00:002026-07-08T00:00:00+00:00https://docs.bugcrowd.com/changelog/customers/vrt-update-119<p>Bugcrowd’s Vulnerability Rating Taxonomy (VRT) has been expanded to include Active Directory (AD) misconfigurations, Kerberos/SCCM abuse vectors, and server security misconfigurations (P1–P5). SSRF classifications have also been streamlined by replacing legacy categories with more granular SSRF metrics.</p>

Bugcrowd’s Vulnerability Rating Taxonomy (VRT) has been expanded to include Active Directory (AD) misconfigurations, Kerberos/SCCM abuse vectors, and server security misconfigurations (P1–P5). SSRF classifications have also been streamlined by replacing legacy categories with more granular SSRF metrics.

2026-05-14T00:00:00+00:002026-05-14T00:00:00+00:00https://docs.bugcrowd.com/changelog/customers/ip-restrictions<p>The IP Restrictions feature allows organization admins to restrict access to their organization based on IP address. By configuring an allowlist, you can ensure that only users connecting from approved IP addresses or CIDR ranges are able to access data within the organization.</p> <p>This setting is configured at the organization level and applies to all admin users associated with that organization.</p>

The IP Restrictions feature allows organization admins to restrict access to their organization based on IP address. By configuring an allowlist, you can ensure that only users connecting from approved IP addresses or CIDR ranges are able to access data within the organization.

2026-05-01T00:00:00+00:002026-05-01T00:00:00+00:00https://docs.bugcrowd.com/changelog/customers/vrt-scope-rules<p>Engagement Briefs, the Submission form, and Security Inbox now support <strong>VRT Scope Rules</strong>. These rules allow you to set reminders and out-of-scope exclusions for VRT items on all or some of your targets or target groups.</p> <p>VRT Scope Rules are intended to set expectations with researchers at or before time of submission. Used judiciously, should reduce noise and triage times across your engagements.</p> <p>For full details, see the <a href="/customers/engagement-management/engagement-vrt-scope-rules/">VRT Scope Rules</a>.</p>

Engagement Briefs, the Submission form, and Security Inbox now support VRT Scope Rules. These rules allow you to set reminders and out-of-scope exclusions for VRT items on all or some of your targets or target groups.

2026-04-29T00:00:00+00:002026-04-29T00:00:00+00:00https://docs.bugcrowd.com/changelog/customers/cvss-v4<p>The CVSS Calculator now supports CVSS 4.0 alongside CVSS 3.1. Program administrators can enable CVSS 4.0 under Program Settings &gt; Submissions, after which all new submissions will default to the new version. Switching versions does not automatically update existing submissions. These must be reviewed manually via the Security Inbox, or updated in bulk through the API.</p> <p>For full details, see the <a href="https://docs.bugcrowd.com/customers/submission-management/cvss/">CVSS documentation</a>.</p>

The CVSS Calculator now supports CVSS 4.0 alongside CVSS 3.1. Program administrators can enable CVSS 4.0 under Program Settings &gt; Submissions, after which all new submissions will default to the new version. Switching versions does not automatically update existing submissions. These must be reviewed manually via the Security Inbox, or updated in bulk through the API.

2026-03-09T00:00:00+00:002026-03-09T00:00:00+00:00https://docs.bugcrowd.com/changelog/customers/vrt-update-118<p>Bugcrowd’s Vulnerability Rating Taxonomy (VRT) has been enhanced to support mappings to auto-suggest CVSS vectors for opt-in customers.</p>

Bugcrowd’s Vulnerability Rating Taxonomy (VRT) has been enhanced to support mappings to auto-suggest CVSS vectors for opt-in customers.

2026-02-02T00:00:00+00:002026-02-02T00:00:00+00:00https://docs.bugcrowd.com/changelog/customers/the-security-inbox<p>We are excited to announce the launch of the new Security Inbox. Designed as a high-performance command center, it offers streamlined triage workflows, powerful customization features, and deeper platform efficiencies to accelerate your time to remediation.</p> <h2 id="whats-new">What’s New</h2> <ul> <li><strong>Saved Views &amp; Pinning:</strong> Design your perfect workflow. Create, share, and pin custom filter sets as tabs for one-click access to your most critical work queues.</li> <li><strong>Focused View Layout:</strong> Maximize productivity with a split-screen interface. View full technical details side-by-side without losing your place (activities, brief, disclosures, etc.)</li> <li><strong>AI Triage Assistant:</strong> Leverage our secure, in-platform AI operational assistant to summarize complex findings, suggest remediation steps, and even generate Nuclei retest templates using natural language.</li> <li><strong>Automated Integration Triggers:</strong> Turn filters into actions. Link your Saved Views directly to Jira or other integrations to automate ticket creation based on your specific criteria.</li> </ul> <h2 id="improved-capabilities">Improved Capabilities</h2> <ul> <li><strong>Advanced Search &amp; Filtering:</strong> Find what you need in seconds. Search by Submission ID, Researcher, or Target with an enhanced filtering engine designed to help you focus on the vulnerabilities that matter most.</li> <li><strong>Modernized UI:</strong> Experience a refreshed, scannable design across the entire Inbox, specifically engineered to reduce cognitive load during high-volume triage sessions.</li> </ul> <h2 id="ready-to-dive-in">Ready to dive in?</h2> <p>To take full advantage of these new features and explore the updated workflows, please visit our <a href="https://docs.bugcrowd.com/customers/security-inbox/the-security-inbox/">Security Inbox Documentation.</a></p>

We are excited to announce the launch of the new Security Inbox. Designed as a high-performance command center, it offers streamlined triage workflows, powerful customization features, and deeper platform efficiencies to accelerate your time to remediation.

2026-01-29T00:00:00+00:002026-01-29T00:00:00+00:00https://docs.bugcrowd.com/changelog/customers/rewards-page-update<h2 id="enhancement-8-hour-reward-cancellation-window">Enhancement: 8-Hour Reward Cancellation Window</h2> <p>We’ve added more flexibility to your reward process. Customers now have a 8-hour window to cancel a reward after it has been issued, allowing you to quickly correct errors before payments are finalized.</p> <ul> <li><strong>Grace Period:</strong> View a real-time countdown for “Processing” rewards.</li> <li><strong>Easy Voiding:</strong> Cancel rewards directly from the Reward History table.</li> <li><strong>Transparency:</strong> Select a reason for cancellation to keep researchers informed.</li> <li><strong>Instant Recovery:</strong> Cancelled funds are immediately returned to your reward pool.</li> </ul> <p>After 8 hours, rewards are marked as <strong>Finalized</strong> and processed for payment.</p> <p>For more details, view the updated <a href="https://docs.bugcrowd.com/customers/quick-start/the-rewards-page/">Rewards Page Documentation</a>.</p>

Enhancement: 8-Hour Reward Cancellation Window

2025-12-10T00:00:00+00:002025-12-10T00:00:00+00:00https://docs.bugcrowd.com/changelog/customers/core-ai-platform<p>We are excited to announce the launch of the new Bugcrowd AI capabilities designed to accelerate remediation, streamline triage, and provide deeper insights into your security posture—all while maintaining strict data privacy and control.</p> <p><strong>1. AI Triage Assistant</strong><br /> Transform triage from a static checklist into a dynamic conversation. The AI Triage Assistant is a secure, in-platform operational assistant embedded directly within the Submission Inbox. It empowers security teams to investigate vulnerabilities using natural language without leaving their primary workflow.</p> <ul> <li><strong>Conversational Investigation</strong>: Ask questions to probe for details, such as “Explain this payload to me as if I were a junior developer” or “Model a potential attack chain for this flaw”.</li> <li><strong>Instant Efficiency</strong>: Generate on-demand artifacts, including remediation guidance and valid Nuclei templates for retesting.</li> <li><strong>Context-Aware</strong>: The assistant automatically references submission details, comments, and engagement metadata to ensure relevance and accuracy.</li> </ul> <p><strong>2. AI Analytics</strong><br /> Unlock deeper insights with natural language querying. AI Analytics empowers Organization Owners to analyze security program data through interactive dashboards and a new “Ask AI” interface.</p> <ul> <li><strong>Ask AI</strong>: Query your program data using natural language (e.g., “What is our average ‘Days to Accept’ compared to last quarter?”) to get instant answers without generating complex reports.</li> <li><strong>Interactive Dashboards</strong>: Visualize security posture with pre-defined reports where selecting data points highlights corresponding data across graphs.</li> <li><strong>Flexible Filtering</strong>: Filter dashboards by date range, program name, or engagement type, and export data to CSV or PDF.</li> </ul> <p><strong>3. AI Connect</strong><br /> The secure “front door” for your internal AI tools. AI Connect is a dedicated Model Context Protocol (MCP) server that securely streams your program data to your internal AI applications.</p> <ul> <li><strong>Bring Your Own Agent</strong>: Connect IDEs like Cursor or GitHub Copilot directly to your Bugcrowd program.</li> <li><strong>Real-Time Data</strong>: Query submission data instantly via a secure Server-Sent Events (SSE) stream—no need to build complex data pipelines or exports.</li> <li><strong>Developer-Ready</strong>: Enable your internal AI to merge vulnerability data with your codebases to generate context-aware remediation advice.</li> </ul> <h2 id="security--data-privacy">Security &amp; Data Privacy</h2> <p><strong>Centralized governance for Generative AI.</strong> We understand that data privacy is paramount. The <strong>Global Control of LLMs</strong> allows Organization Owners to centrally manage the use of GenAI features across their organization. Organization Owners can Enable or Disable all LLM-powered features (like <strong>AI Triage Assistant</strong> and <strong>Ask AI</strong>) with a single action.</p> <p>The Bugcrowd AI Capabilities is built on a <strong>“Zero Training Policy.”</strong></p> <ul> <li><strong>No Training</strong>: Your data is never used to train third-party models.</li> <li><strong>Inference Only</strong>: Data is used solely to generate the feature’s immediate output and is not retained.</li> <li><strong>Secure Infrastructure</strong>: All LLMs are hosted securely within Bugcrowd’s infrastructure.</li> </ul> <h2 id="for-more-information-and-documentation">For More Information and Documentation:</h2> <ul> <li><a href="https://docs.bugcrowd.com/customers/ai-capabilities/ai-analytics/"><strong>AI Analytics: Ask AI</strong></a></li> <li><a href="https://docs.bugcrowd.com/customers/reporting-organization/organization-analytics/"><strong>Organization Analytics</strong></a></li> <li><a href="https://docs.bugcrowd.com/customers/ai-capabilities/ai-triage-assistant/"><strong>AI Triage Assistant</strong></a></li> <li><a href="https://docs.bugcrowd.com/customers/ai-capabilities/ai-connect/"><strong>AI Connect</strong></a></li> <li><a href="https://docs.bugcrowd.com/customers/ai-capabilities/global-controls-of-llm/"><strong>Global Control of LLMs</strong></a></li> </ul>

We are excited to announce the launch of the new Bugcrowd AI capabilities designed to accelerate remediation, streamline triage, and provide deeper insights into your security posture—all while maintaining strict data privacy and control.

2025-11-17T00:00:00+00:002025-11-17T00:00:00+00:00https://docs.bugcrowd.com/changelog/customers/request-a-response<p>We have enhanced the Request a Response feature to foster stronger collaboration between customers and researchers, ensuring more timely and effective submission resolution.</p> <h2 id="whats-new">What’s New</h2> <h3 id="1-automatic-expiration">1. Automatic Expiration</h3> <p>Any open RaR will <strong>automatically expire after 10 business days</strong> if no response is provided by the party that the request was directed to.</p> <ul> <li>To prevent expiration and maintain Researcher engagement, please ensure your team responds to or triages submissions with an active RaR within this 10-business-day window.</li> <li>The expiration event is recorded in the submission’s <strong>Activity Log</strong>.</li> </ul> <h3 id="2-increased-researcher-quota">2. Increased Researcher Quota</h3> <ul> <li>Researchers can now have <strong>2 open RaR</strong> at any given time (previously the limit was 1).</li> <li>This allows for more collaboration and may result in a slight increase in RaR activity on your submissions.</li> </ul> <p><em>For more details on how to use this functionality, see</em> <a href="https://docs.bugcrowd.com/customers/submission-management/responding-to-a-request-response/"><strong>Responding to a Request a Response</strong></a></p>

We have enhanced the Request a Response feature to foster stronger collaboration between customers and researchers, ensuring more timely and effective submission resolution.