BUGCROWD REPORTING — Program-Specific Tactics

Companion to the generic report-writing skill. Use when working specifically on Bugcrowd submissions where VRT mapping, OOS-clause rebuttals, or per-program target selection matter.

This skill encodes patterns that apply specifically to Bugcrowd's submission flow. For the generic per-platform templates (HackerOne / Bugcrowd / Intigriti / Immunefi report bodies), use the report-writing skill. For the 7-Question Gate before deciding to report at all, use triage-validation.

1. VRT Category Selection — Search & Fallback Strategy

Bugcrowd's submission form requires a single VRT (Vulnerability Rating Taxonomy) selection. The dropdown's default severity is bound to the chosen node — pick wrong and the form auto-suggests a lower priority (often P4) when the actual impact is P3 or P2.

Note: VRT default severities are not fixed constants. Bugcrowd revises the VRT schema across versions, and individual programs can remap defaults via their own priority configuration. The P-values shown in the examples below (e.g., "No Rate Limiting on Form → Login" defaulting to P4) are the typical baseline at time of writing — always read the severity the current form actually auto-suggests for this program rather than assuming the value here.

1.1 Search hierarchy (try in order, pick the highest-severity match that still describes the bug)

For any finding, search the VRT dropdown with these terms in this order:

1. The bug's primary class — e.g., IDOR, XSS, SSRF, auth bypass, 2FA bypass
2. The data category exposed — e.g., PII, sensitive data exposure, disclosure of secrets
3. The control bypassed — e.g., broken access control, authentication bypass
4. The endpoint type — e.g., no rate limiting on form > login, no rate limiting on form > change password
5. The generic parent node — e.g., Server Security Misconfiguration > Other, Broken Access Control > Other

1.2 Pick the highest-severity match that still accurately describes the bug

Never select a VRT that misrepresents the bug just to get a higher default severity. Triagers will reassign and may flag the misrepresentation. The discipline is: pick the most specific accurate VRT, then use §2 (Manual Severity Override) if the default is wrong.

1.3 Common mappings worth knowing

1.4 If no good VRT exists

Pick Server Security Misconfiguration → Other or Broken Access Control → Other and lead the description body with a "VRT mapping note" explaining why the chosen node is the closest available match and what the bug actually is.

2. Manual Severity Override

Bugcrowd's form lets you manually set Technical Severity separate from the VRT default. The form text itself states: "A severity rating suggested by the VRT is not guaranteed to be the severity rating applied to your submission."

2.1 When to override

Override the VRT default when:

• The chained outcome is a higher severity than the standalone bug class (chain → ATO)
• The VRT category is approximate and its default doesn't reflect the actual impact class

…