bugcrowd-reporting

Guides Bugcrowd submissions with VRT selection, severity overrides, and OOS rebuttal templates.

Updated Sep 6, 2026
One-click install
npx skills add https://github.com/inventashif/helpful-code-sidekick --skill bugcrowd-reporting-inventashif
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: bugcrowd-reporting
Source: https://github.com/inventashif/helpful-code-sidekick/tree/main/scripts/hackerai/skills/bughunter/bugcrowd-reporting
Command: npx skills add https://github.com/inventashif/helpful-code-sidekick --skill bugcrowd-reporting-inventashif

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Bugcrowd submissions often get auto-closed or downgraded because researchers pick the wrong VRT category, accept an underrated default severity, or fail to rebut out-of-scope clauses. This Skill provides the program-specific tactics needed to file Bugcrowd reports that survive triage. ## Core Features & Use Cases - VRT Search & Fallback Strategy: Ordered search hierarchy for the VRT dropdown, common finding-to-category mappings, and guidance for writing a VRT mapping note when no exact node exists. - Manual Severity Override: Instructions for setting Technical Severity independently of the VRT default, plus a severity-request paragraph template placed first in the report body. - OOS-Clause Rebuttal Templates: Ready-made in-scope justification sections for rate-limiting, debug-info, user-enumeration, and theoretical-issue objections. - Chained Findings & Submission Order: Cross-reference templates for multi-report chains, QA-vs-production target selection, and researcher hygiene (Bugcrowdninja alias, account restoration, session rotation). - Use Case: You found a password-verification endpoint with no rate limiting on a Bugcrowd program. Use this Skill to map it to the right VRT node, override the P4 default to P3 with a severity-request paragraph, and pre-empt the "non-authentication endpoint" OOS clause. ## Quick Start Help me file a Bugcrowd submission for a no-rate-limiting finding on a login endpoint, including the right VRT category and a severity-request paragraph.

Frequently Asked Questions about bugcrowd-reporting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I choose the right VRT category on Bugcrowd?

Search the VRT dropdown in order: the bug's primary class, the data category exposed, the control bypassed, the endpoint type, then the generic parent node. Pick the highest-severity match that still accurately describes the bug, and use a VRT mapping note if no exact node exists.

How do I request a higher severity than the Bugcrowd VRT default?

Set the Technical Severity field manually, separate from the VRT default. Then place a severity-request paragraph as the first body section, citing impact axes, the program's Focus Areas, and cross-referenced chained submissions.

How do I rebut an out-of-scope closure on Bugcrowd?

Include an in-scope justification section that quotes the OOS clause and explains why it does not apply. Templates exist for rate-limiting on authentication endpoints, debug-info framing, user enumeration leaking real PII, and theoretical-issue objections.

Should chained vulnerabilities be filed as one Bugcrowd report or several?

File each primitive as a separate report at its standalone severity first, then file the chain consumer referencing their UUIDs, and edit the primitives to backfill the consumer's UUID. This respects the one-fix-one-bounty rule while amplifying chained severity.

When should I not file a Bugcrowd submission?

Do not file when you only have an API behavior observation without a demonstrated end-to-end exploitation path, since theoretical findings damage researcher reputation. Also avoid over-claiming P1 severity, which erodes triager trust.