What problem does it solve?
This Skill solves the common pain points of Bugcrowd bug bounty submissions being auto-closed, under-severity rated, or rejected due to incorrect VRT category selection, weak out-of-scope (OOS) clause rebuttals, or improper target selection for QA versus production programs.
Core Features & Use Cases
- VRT Category Selection & Fallback Strategy: Guides you to pick the most accurate Vulnerability Rating Taxonomy category using a prioritized search hierarchy, with common mapping examples for frequent finding types like account takeover primitives and PII enumeration.
- Severity Override & Argument Templates: Provides structured templates to argue for correct severity ratings when Bugcrowd's VRT defaults underrate your finding's real impact, including pre-written severity request paragraphs that triagers recognize to avoid auto-closure.
- OOS-Clause Rebuttal Templates: Offers pre-built justifications for common auto-closure reasons including rate limiting on authentication endpoints, debug information disclosure claims, and low-risk user enumeration allegations.
- Chained Finding Cross-Reference Patterns: Outlines the correct submission order and cross-reference format for multi-primitive vulnerability chains to secure higher combined bounties aligned with Bugcrowd's "one fix = one bounty" rule.
- QA vs Production Target Selection Guidance: Helps you pick the correct program target entry and draft appropriate disclaimers when testing in QA environments to avoid scope violations.
- Researcher Hygiene Best Practices: Covers Bugcrowd-specific rules like using Bugcrowdninja email aliases, immediate account state restoration after proof-of-concept testing, and session rotation to maintain platform credibility.
Use Case: If you discover a password verification endpoint with no rate limiting that enables account takeover when chained with a session theft vulnerability, this skill guides you to select the correct VRT category, draft a severity request to argue for P2 impact instead of the default P4, rebut any OOS closure claims that the endpoint is "non-authentication", and properly cross-reference the two related submissions for chained severity evaluation.
Quick Start
Use the bugcrowd-reporting skill to map your account takeover finding to the correct VRT category, draft a severity request paragraph arguing for P2 impact, and include an in-scope justification to rebut potential out-of-scope closures for rate-limiting issues on authentication endpoints.
