Submission Limit
To protect triage capacity and prioritize high-signal research, Bugcrowd implements submission limits for accounts with limited historical performance. These measures are designed to reinforce accountability and ensure that high-quality, validated findings receive the attention and speed they deserve.
Scope & Eligibility
This policy is designed to encourage growth and quality within the researcher community.
- This applies to Managed Bug Bounty (MBB) engagements only. Vulnerability Disclosure Programs (VDPs) and Pen Tests are currently excluded from these limits.
- Accounts with a proven track record of quality submissions and performance are exempt from these limits.
- Accounts falling below 50% accuracy on the last 90 days are limited to 6 submissions per week on Managed Bug Bounty (MBB) programs.
- Once throttled, an account remains throttled for a minimum of 7 consecutive days, regardless of whether accuracy goes back above 50% during that week.
- Limits are evaluated once you have made 10 submissions in the last 90 days. We use your 90-day accuracy if at least 5 of your submissions have reached a final state. Otherwise, we use your lifetime submission accuracy until we can switch to 90-day accuracy.
- All researchers must also complete mandatory Identity Verification prior to participating in Managed Bug Bounty engagements.
Alerts
To help you track these limits, the platform provides informative warnings and blocking alerts directly on the submission page.
Tips for Success
- If you reach the submission limit, the most effective way to restore your submission ability is to focus on the quality and validation of your research rather than the volume of reports.
- Focus on thorough report validation and accuracy to ensure your account meets the performance threshold when your 7-day minimum throttle period completes.
FAQs
1. What is the submission limit?
Accounts subject to this policy are limited to 6 submissions per week on Managed Bug Bounty (MBB) programs.
2. Can I replace one of my submissions for another?
No, you cannot replace a submitted report.
3. Does this limit apply to my account?
The limit applies to accounts with limited historical performance (specifically when trailing 90-day accuracy falls below 50%, evaluated once you have made 10 submissions in the last 90 days). Accounts with a proven track record of quality and impactful submissions are exempt.
4. Which programs does this limit apply to?
The limit applies to Managed Bug Bounty (MBB) programs only. Vulnerability Disclosure Programs (VDPs) and Pen Tests are excluded.
5. How long does a throttle stay in effect?
Once an account enters a throttled state due to accuracy dropping below 50%, the throttle remains active for a minimum of 7 consecutive days.
6. How will I know if I am approaching or have reached my limit?
The platform displays informative warnings and blocking alerts directly on the submission page, and you will also receive an email notification when you reach the limit.
7. What can I do if I’ve reached my submission limit?
You will need to wait for a minimum of 7 days before submitting to MBBs again. In the meantime, focus on the quality, suitability (In Scope) and relevance of submissions considering the engagement you’re submitting to, including its Brief and Targets.
