Bugcrowd

No entries match these filters. Clear filters

1. New Organization Roles for Assets and Savant Pathseeker (2026-11-02) Nov 2, 2026 · issue 129

   Bugcrowd adds three organization-level roles — Test Operator, Asset Owner, and Asset Viewer — to scope access to Savant Pathseeker tests and asset inventory without granting⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds a new Test Operator organization role that can launch, stop, and configure Savant Pathseeker autonomous tests across approved assets, and read asset inventory to select test targets — must be explicitly granted by an Organization Owner and is not included with any program role by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a new Asset Owner organization role that can manage asset inventory, discovery, scans, and groups, and triage findings across all programs.
   • Adds a new Asset Viewer organization role that can view asset inventory, the discovery feed, and scan status, and view findings across all programs.
   • The Organization Owner role now includes full access to assets in addition to all security programs and submissions.
   • Adds a new Test Operator organization role that can launch, stop, and configure Savant Pathseeker autonomous tests across approved assets, and read asset inventory to select test targets — must be explicitly granted by an Organization Owner and is not included with any program role by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a new Asset Owner organization role that can manage asset inventory, discovery, scans, and groups, and triage findings across all programs.
   • Adds a new Asset Viewer organization role that can view asset inventory, the discovery feed, and scan status, and view findings across all programs.

   1 more in Everything

2. changelog Oct 20, 2026 · issue 114

   Bugcrowd adds API support for triggering Savant Pathseeker Tests programmatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Enables triggering Savant Pathseeker Tests via the API, allowing automated or pipeline-driven test execution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

3. Trigger Savant Pathseeker Tests with the API (2026-10-13) Oct 13, 2026 · issue 108

   Bugcrowd adds a POST /scan_configurations/{id}/scan_executions endpoint to trigger Savant Pathseeker tests from CI/CD pipelines and APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Trigger a Pathseeker retest of your staging environment after each CI/CD release, tagging the run with the pipeline source for traceability.
   copy

   $ curl -X POST https://api.bugcrowd.com/scan_configurations/{id}/scan_executions \
     -H 'Authorization: Token <api_token>' \
     -H 'Content-Type: application/json' \
     -d '{"trigger_source": "github-actions"}'

   Enable API-triggered runs for a Pathseeker test and retrieve its Configuration ID so it can be referenced in automation.
   📍In the Pathseeker test setup, turn on Allow API-triggered runs. Copy the displayed Configuration ID. To retrieve it later, go to the test's Test Overview page and reopen the setup instructions.
   • Adds POST /scan_configurations/{id}/scan_executions endpoint (API v1.2.0) to start an existing Pathseeker test programmatically using its saved targets, credentials, and settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds trigger_source label field on API-triggered runs to record the origin (e.g., github-actions) alongside the token owner and timestamp for full run traceability.
   • Adds Allow API-triggered runs option in Pathseeker test setup, which surfaces a Configuration ID used to reference the test in API calls.
   • Exposes the Configuration ID and setup instructions from the test's Test Overview page after enabling API-triggered runs.

   4 details in Everything

4. changelog Oct 3, 2026 · issue 093

   Bugcrowd adds Request a Response Withdrawal capability for customers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   When you need to retract a previously submitted response on a program, use the new withdrawal request flow in the Bugcrowd customer portal.
   📍In the Bugcrowd customer portal, navigate to the relevant submission, then select Request a Response Withdrawal to initiate the withdrawal process.
5. docs update Sep 28, 2026 · issue 088

   Bugcrowd adds Response Withdrawal requests for both researchers and customers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   When a researcher needs to retract a previously submitted response on a submission.
   📍In the Bugcrowd platform, navigate to the relevant submission as a researcher, then go to Researchers › Request a Response Withdrawal and submit the withdrawal request.
   When a customer needs to withdraw a response on a submission from their side of the platform.
   📍In the Bugcrowd platform, navigate to the relevant submission as a customer, then go to Customers › Request a Response Withdrawal and submit the withdrawal request.
   • Enables researchers to request a response withdrawal through the new Request a Response Withdrawal workflow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Enables customers to request a response withdrawal through the new Request a Response Withdrawal workflow.

   2 details in Everything

6. Request a Response Withdrawal (2026-09-28) Sep 28, 2026 · issue 088

   Bugcrowd adds withdrawal tracking for Request a Response, with a dedicated Withdrawn requests to Customer filter in Security Inbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Review all RaRs a researcher has withdrawn to audit outstanding response obligations and close out stale items.
   📍In Security Inbox, open the filters panel and select Withdrawn requests to Customer to list all withdrawn RaRs, then expand any entry in the submission's Activity feed to view the researcher's stated withdrawal reason.
   • Filters withdrawn Request a Response (RaR) submissions via the Withdrawn requests to Customer filter in Security Inbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Automatically removes researcher-withdrawn RaRs from active queues and preserves them as expandable items in the submission's Activity feed with the withdrawal reason.
   • Filters withdrawn Request a Response (RaR) submissions via the Withdrawn requests to Customer filter in Security Inbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

7. docs update Sep 23, 2026 · issue 083

   Bugcrowd adds Submission Collaborator, enabling researchers to collaborate on bug submissions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

8. changelog Sep 8, 2026 · issue 068

   Bugcrowd: Enables linking Autonomous Pentest Vulnerability Detections to Jira issues.

9. docs update Sep 7, 2026 · issue 067

   Bugcrowd adds Jira linking for Vulnerability Detections

   └──▷ HOW TO FIND IT
   When triaging a vulnerability detection, link it to an existing or new Jira issue to track remediation in your existing workflow.
   📍In the Bugcrowd platform, go to Customers › Linking Vulnerability Detections to Jira and follow the steps to link a Vulnerability Detection to a Jira issue.
10. docs update Sep 7, 2026 · issue 067

    Bugcrowd Autonomous Pentest adds Jira integration for linking Vulnerability Detections directly to Jira issues.

11. Linking Vulnerability Detections to Jira (2026-09-06) Sep 6, 2026 · issue 067

    Bugcrowd Jira integration now supports Vulnerability Detections — push or link detections from the Security Inbox alongside submissions.

    • Adds Push and Link actions in a Vulnerability Detection's Integrations panel to create a new Jira issue or connect to an existing one, keeping remediation tracked in Jira in sync with risk data in Crowdcontrol.
    • Enables bidirectional comment sync and on-demand update pushes for Jira-linked Vulnerability Detections, with the ability to edit or remove the link at any time.
    • Adds Push and Link actions in a Vulnerability Detection's Integrations panel to create a new Jira issue or connect to an existing one, keeping remediation tracked in Jira in sync with risk data in Crowdcontrol.

    1 more in Everything

12. changelog Aug 31, 2026 · issue 060

    Bugcrowd adds Vulnerability Detection Report generation and Request a Response expiration removal controls.

    └──▷ HOW TO FIND IT
    Review and export a Vulnerability Detection Report after running a vulnerability scan against your program.
    📍In the Bugcrowd platform, go to Vulnerability Scanning › Generating Vulnerability Detection Report, then select your scan and download the Vulnerability Detection Report.
    • Adds ability to remove the expiration on a Request a Response, extending researcher response windows beyond the default deadline.
    • Adds capability to respond directly to a Request a Response from within the platform.
    • Adds Vulnerability Detection Report generation under Vulnerability Scanning, providing exportable scan findings for customer programs.

    3 details in Everything

13. docs update Aug 25, 2026 · issue 056

    Bugcrowd researchers can now request removal of a response expiration on a submission.

14. Request a Response Expiration Removal (2026-08-25) Aug 25, 2026 · issue 056

    Bugcrowd Request a Response no longer auto-expires, with new inbox filters for active and resolved requests.

    └──▷ HOW TO FIND IT
    Quickly surface all outstanding researcher requests that need your team's attention using the new inbox filter.
    📍In the Bugcrowd inbox, open the filter panel and select Active requests to Customers to see all open RaRs awaiting a response.
    • Each RaR now displays the date it was raised so teams can track how long a request has been open.
    • New inbox filters let you view RaRs by status: Active requests to Customers to surface outstanding requests and Resolved requests to Customers to review handled ones.

    2 details in Everything

15. Generating Vulnerability Detection Report (2026-08-25) Aug 25, 2026 · release notes

    Bugcrowd adds organization-level Vulnerability Detection Report generation via UI with PDF export

    • Enables generation of a Vulnerability Detection Report at the organization level for Bugcrowd customers.

    1 detail in Everything

16. changelog Aug 23, 2026 · issue 054

    Bugcrowd launches Savant Pathseeker 1.0 in Early Access, introducing autonomous pentesting capability.

17. docs update Aug 18, 2026 · issue 049

    Bugcrowd launches Savant Pathseeker: autonomous outside-in pentesting with authenticated testing, WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. evasion, and Security Inbox integration.

    └──▷ HOW TO FIND IT
    Set up an authenticated Pathseeker test so it can reach and assess content behind a login page, including an Okta or Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. redirect.
    📍In Autonomous Tests › New Autonomous Test, open the credential step, enter the username and password for the test account, and save. Pathseeker will log in automatically when the test detects a login page and test everything behind the authentication wall.
    Add a net-new domain to scope without leaving the Pathseeker test setup wizard.
    📍In the target field, type the asset name. When no match is found, select 'Create and approve a new asset?', complete the name, URL, type, and business criticality fields, then save. Pathseeker creates, approves, and adds the asset as a target in one action.
    Promote a validated finding into the vulnerability-management workflow without manual re-entry.
    📍From the test Results tab, select one or more findings, then click Push to Inbox and confirm in the dialog. The finding appears in Security Inbox within seconds, labeled as Autonomous Test Vulnerabilities.
    • New Savant Pathseeker product runs autonomous, controlled outside-in penetration tests against approved internet-facing domains, web apps, and APIs, producing validated findings with evidence.
    • Authenticated testing support lets Pathseeker log in with stored credentials and test content behind login pages, including apps that redirect through external identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. such as Okta, Entra ID, or Google.
    • Bot detection and WAF evasion capability adapts to perimeter controls within authorized boundaries so test coverage reflects what a real attacker could reach.
    • Asset targeting lets practitioners search an approved asset inventory or add and approve a new asset — name, URL, type, and business criticality — directly from Pathseeker test setup without switching tabs.
    • Push to Inbox action promotes validated Pathseeker findings into the Security Inbox in one click; findings are labeled as Autonomous Test Vulnerabilities and link back to the originating test run; duplicate pushes are blocked.

    +2 more show less

    • Findings delivery integrates Pathseeker results alongside other detections and submissions already in the Security Inbox, removing manual re-entry.
    • Organization owner permissions are required to launch a Pathseeker test; targets must be pre-approved in the asset inventory before testing can begin.

    7 details in Everything

18. docs update Aug 18, 2026 · issue 049

    Bugcrowd launches Savant Pathseeker Early Access (1.0) for customers.

19. docs update Aug 18, 2026 · issue 049

    Bugcrowd launches Savant Pathseeker Early Access (1.0), an autonomous pentesting capability.

20. Savant Pathseeker Early Access (1.0) (2026-08-17) Aug 17, 2026 · issue 049

    Bugcrowd launches Savant Pathseeker Early Access: autonomous penetration testing with authenticated test support and findings integration.

    • New Savant Pathseeker product enables autonomous penetration testing, now available in Early Access.
    • Supports authenticated tests behind login, including external identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
    • Enables adding assets mid-setup during an autonomous test run.
    • Pushes validated findings to the Security Inbox for triage and workflow integration.

    4 details in Everything

21. Savant Pathseeker Early Access (1.0) (2026-08-17) Aug 17, 2026 · issue 008

    Bugcrowd launches Savant Pathseeker Early Access: autonomous penetration testing with authenticated test support and findings integration.

    • New Savant Pathseeker product enables autonomous penetration testing, now available in Early Access.
    • Supports authenticated tests behind login, including external identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
    • Enables adding assets mid-setup during an autonomous test run.
    • Pushes validated findings to the Security Inbox for triage and workflow integration.

    4 details in Everything

22. changelog Aug 15, 2026 · issue 046

    Bugcrowd adds FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. support for government and compliance-sensitive customers.

23. docs update Aug 15, 2026 · issue 046

    Bugcrowd adds on-demand Vulnerability Detections dashboard and DNS Records CSV export for audit and leadership reporting.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Generate a DNS records CSV for a quarter to hand auditors a defensible record of attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. growth without waiting on engineering.
    📍Go to Organization › Reports, click Generate report, select DNS records (csv) from the dropdown, provide a Report Title and Date Range, then click Generate report. Download the artifact from the Reports page once the email notification arrives.
    Scope the Vulnerability Detections dashboard to a specific business unit before a leadership review.
    📍Go to Organization › AI Analytics, click the Vulnerability Detections tab, then apply filters for date range, vulnerability priority, asset group, or asset owner to focus on the relevant business unit.
    • Adds a Vulnerability Detections tab under Organization > AI Analytics with filters for date range, vulnerability priority, asset group, and asset owner to scope posture views to a specific business unit or asset owner.
    • Adds a DNS records (csv) report type under Organization > Reports that exports a point-in-time inventory of discovered assets — names, types, and discovery source — filterable by creation date range, for auditors and board reporting.
    • Generated reports are delivered via email when ready and are accessible by all Owner roles from the Reports page as timestamped point-in-time snapshots.

    3 details in Everything

24. docs update Aug 15, 2026 · issue 046

    Bugcrowd adds FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. support for government and compliance-sensitive customers.

    • Adds FedRAMP support, enabling use of Bugcrowd in federal and compliance-regulated environments.

    1 detail in Everything

25. changelog Aug 8, 2026 · issue 039

    Bugcrowd adds a DNS Records Report generation capability.

    • New DNS Records Report available for generation within the platform.

    1 detail in Everything

26. docs update Aug 8, 2026 · issue 039

    Bugcrowd adds a DNS Records Report generation capability

    • Adds the ability to generate a DNS Records Report within the platform.

    1 detail in Everything

27. changelog Jul 31, 2026 · issue 031

    Bugcrowd adds managing and assigning researcher credentials for customers.

    • Enables customers to manage and assign researcher credentials within the Bugcrowd platform.

    1 detail in Everything

28. docs update Jul 31, 2026 · issue 031

    Bugcrowd adds managed researcher credential assignment for customers.

    • Enables customers to manage and assign researcher credentials directly within the platform.

    1 detail in Everything

29. Savant Vista Public Beta (1.0) (2026-07-14) Jul 14, 2026 · issue 016

    Bugcrowd Savant Vista enters Public Beta with autonomous asset discovery, vulnerability scanning, and baseline setup.

    • New Savant Vista platform introduces autonomous asset/estate discovery capabilities.
    • Adds vulnerability baseline setup workflow for establishing a known-good state before scanning.
    • Supports launching autonomous vulnerability scans against discovered assets.

    3 details in Everything

30. VRT Update (1.19.1) (2026-07-08) Jul 8, 2026 · issue 014

    Bugcrowd VRT 1.19.1 adds Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments., KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application./SCCM, and server misconfiguration categories plus granular SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. classifications.

    • Adds Active Directory misconfiguration entries to the VRT, covering a new class of findings for AD-related vulnerabilities.
    • Adds Kerberos and SCCM abuse vectors as distinct VRT categories, enabling more precise classification of common internal attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately..
    • Adds server security misconfiguration classifications rated across the full P1–P5 severity spectrum.
    • Replaces legacy SSRF categories with granular SSRF metrics, enabling finer-grained severity differentiation for server-side request forgeryserver-side request forgeryServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. findings.

    4 details in Everything

31. IP Restrictions (2026-05-14) May 14, 2026 · release notes

    IP Restrictions feature allows org admins to restrict access based on an IP allowlist

    └──▷ HOW TO FIND IT
    Restrict org access to specific CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. blocks for admin users
    📍In the console, go to Organization Settings › IP Restrictions and add your approved IP ranges to the allowlist.
    • Adds IP Restriction configuration at the organization level to enforce access via an allowlist of approved IP addresses or CIDR ranges

    1 detail in Everything

32. CVSS v4.0 Support Added (2026-04-29) Apr 29, 2026 · release notes

    CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. Calculator adds CVSS 4.0 support with UI toggle and bulk API updates

    • Program Settings > Submissions now allows enabling CVSS 4.0 for new submissions

    1 detail in Everything