https://cybertoolchain.io/tools/bugcrowd New releases and features in Bugcrowd, tracked by The Cyber Toolchain. en Mon, 02 Nov 2026 00:00:00 GMT https://docs.bugcrowd.com/changelog/customers/new-organization-roles-for-assets-and-pathseeker/ https://docs.bugcrowd.com/changelog/customers/new-organization-roles-for-assets-and-pathseeker/ Mon, 02 Nov 2026 00:00:00 GMT Bugcrowd adds three organization-level roles — Test Operator, Asset Owner, and Asset Viewer — to scope access to Savant Pathseeker tests and asset inventory without granting⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a new 'Test Operator' organization role that can launch, stop, and configure Savant Pathseeker autonomous tests across approved assets, and read asset inventory to select test targets — must be explicitly granted by an Organization Owner and is not included with any program role by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a new 'Asset Owner' organization role that can manage asset inventory, discovery, scans, and groups, and triage findings across all programs. • Adds a new 'Asset Viewer' organization role that can view asset inventory, the discovery feed, and scan status, and view findings across all programs. • The 'Organization Owner' role now includes full access to assets in addition to all security programs and submissions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bugcrowd https://docs.bugcrowd.com/customers/changelog https://docs.bugcrowd.com/customers/changelog Tue, 20 Oct 2026 07:55:03 GMT Bugcrowd adds API support for triggering Savant Pathseeker Tests programmatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables triggering Savant Pathseeker Tests via the API, allowing automated or pipeline-driven test execution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bugcrowd https://docs.bugcrowd.com/changelog/customers/trigger-savant-pathseeker-tests-with-the-api/ https://docs.bugcrowd.com/changelog/customers/trigger-savant-pathseeker-tests-with-the-api/ Tue, 13 Oct 2026 00:00:00 GMT Bugcrowd adds a `POST /scan_configurations/{id}/scan_executions` endpoint to trigger Savant Pathseeker tests from CI/CD pipelines and APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `POST /scan_configurations/{id}/scan_executions` endpoint (API v1.2.0) to start an existing Pathseeker test programmatically using its saved targets, credentials, and settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `trigger_source` label field on API-triggered runs to record the origin (e.g., `github-actions`) alongside the token owner and timestamp for full run traceability. • Adds 'Allow API-triggered runs' option in Pathseeker test setup, which surfaces a Configuration ID used to reference the test in API calls. • Exposes the Configuration ID and setup instructions from the test's Test Overview page after enabling API-triggered runs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bugcrowd https://docs.bugcrowd.com/customers/changelog https://docs.bugcrowd.com/customers/changelog Sat, 03 Oct 2026 12:54:09 GMT Bugcrowd adds Request a Response Withdrawal capability for customers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds 'Request a Response Withdrawal' to allow customers to formally request that a submitted response be withdrawn.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bugcrowd https://docs.bugcrowd.com/changelog/customers/rar-withdrawal/ https://docs.bugcrowd.com/changelog/customers/rar-withdrawal/ Mon, 28 Sep 2026 00:00:00 GMT Bugcrowd adds withdrawal tracking for Request a Response, with a dedicated 'Withdrawn requests to Customer' filter in Security Inbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Filters withdrawn Request a Response (RaR) submissions via the `Withdrawn requests to Customer` filter in Security Inbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Automatically removes researcher-withdrawn RaRs from active queues and preserves them as expandable items in the submission's Activity feed with the withdrawal reason. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bugcrowd https://docs.bugcrowd.com/customers/changelog https://docs.bugcrowd.com/customers/changelog Tue, 08 Sep 2026 07:44:43 GMT Bugcrowd: Enables linking Autonomous Pentest Vulnerability Detections to Jira issues. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bugcrowd https://docs.bugcrowd.com/changelog/customers/linking-vulnerability-detections-to-jira/ https://docs.bugcrowd.com/changelog/customers/linking-vulnerability-detections-to-jira/ Sun, 06 Sep 2026 00:00:00 GMT Bugcrowd Jira integration now supports Vulnerability Detections — push or link detections from the Security Inbox alongside submissions. • Adds 'Push' and 'Link' actions in a Vulnerability Detection's Integrations panel to create a new Jira issue or connect to an existing one, keeping remediation tracked in Jira in sync with risk data in Crowdcontrol. • Enables bidirectional comment sync and on-demand update pushes for Jira-linked Vulnerability Detections, with the ability to edit or remove the link at any time. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bugcrowd https://docs.bugcrowd.com/customers/changelog https://docs.bugcrowd.com/customers/changelog Mon, 31 Aug 2026 07:40:47 GMT Bugcrowd adds Vulnerability Detection Report generation and Request a Response expiration removal controls. • Adds ability to remove the expiration on a 'Request a Response', extending researcher response windows beyond the default deadline. • Adds capability to respond directly to a 'Request a Response' from within the platform. • Adds Vulnerability Detection Report generation under Vulnerability Scanning, providing exportable scan findings for customer programs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bugcrowd https://docs.bugcrowd.com/changelog/customers/rar-expiration-removal/ https://docs.bugcrowd.com/changelog/customers/rar-expiration-removal/ Tue, 25 Aug 2026 00:00:00 GMT Bugcrowd Request a Response no longer auto-expires, with new inbox filters for active and resolved requests. • Each RaR now displays the date it was raised so teams can track how long a request has been open. • New inbox filters let you view RaRs by status: 'Active requests to Customers' to surface outstanding requests and 'Resolved requests to Customers' to review handled ones. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bugcrowd https://docs.bugcrowd.com/customers/changelog https://docs.bugcrowd.com/customers/changelog Sun, 23 Aug 2026 09:03:20 GMT Bugcrowd launches Savant Pathseeker 1.0 in Early Access, introducing autonomous pentesting capability. • Introduces Savant Pathseeker 1.0 in Early Access, an autonomous pentesting capability on the Bugcrowd platform. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bugcrowd https://docs.bugcrowd.com/changelog/customers/pathseeker-early-access/ https://docs.bugcrowd.com/changelog/customers/pathseeker-early-access/ Mon, 17 Aug 2026 00:00:00 GMT Bugcrowd launches Savant Pathseeker Early Access: autonomous penetration testing with authenticated test support and findings integration. • New Savant Pathseeker product enables autonomous penetration testing, now available in Early Access. • Supports authenticated tests behind login, including external identity providers. • Enables adding assets mid-setup during an autonomous test run. • Pushes validated findings to the Security Inbox for triage and workflow integration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bugcrowd https://docs.bugcrowd.com/changelog/customers/pathseeker-early-access/ https://docs.bugcrowd.com/changelog/customers/pathseeker-early-access/ Mon, 17 Aug 2026 00:00:00 GMT Bugcrowd launches Savant Pathseeker Early Access: autonomous penetration testing with authenticated test support and findings integration. • New Savant Pathseeker product enables autonomous penetration testing, now available in Early Access. • Supports authenticated tests behind login, including external identity providers. • Enables adding assets mid-setup during an autonomous test run. • Pushes validated findings to the Security Inbox for triage and workflow integration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bugcrowd https://docs.bugcrowd.com/customers/changelog https://docs.bugcrowd.com/customers/changelog Sat, 15 Aug 2026 09:05:16 GMT Bugcrowd adds FedRAMP support for government and compliance-sensitive customers. • Adds FedRAMP support, enabling government and compliance-sensitive organizations to use Bugcrowd within FedRAMP-authorized environments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bugcrowd https://docs.bugcrowd.com/customers/changelog https://docs.bugcrowd.com/customers/changelog Sat, 08 Aug 2026 05:09:43 GMT Bugcrowd adds a DNS Records Report generation capability. • New DNS Records Report available for generation within the platform. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bugcrowd https://docs.bugcrowd.com/customers/changelog https://docs.bugcrowd.com/customers/changelog Fri, 31 Jul 2026 16:20:16 GMT Bugcrowd adds managing and assigning researcher credentials for customers. • Enables customers to manage and assign researcher credentials within the Bugcrowd platform. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bugcrowd https://docs.bugcrowd.com/changelog/customers/savant-vista-public-beta/ https://docs.bugcrowd.com/changelog/customers/savant-vista-public-beta/ Tue, 14 Jul 2026 00:00:00 GMT Bugcrowd Savant Vista enters Public Beta with autonomous asset discovery, vulnerability scanning, and baseline setup. • New Savant Vista platform introduces autonomous asset/estate discovery capabilities. • Adds vulnerability baseline setup workflow for establishing a known-good state before scanning. • Supports launching autonomous vulnerability scans against discovered assets. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bugcrowd https://docs.bugcrowd.com/changelog/customers/vrt-update-119/ https://docs.bugcrowd.com/changelog/customers/vrt-update-119/ Wed, 08 Jul 2026 00:00:00 GMT Bugcrowd VRT 1.19.1 adds Active Directory, Kerberos/SCCM, and server misconfiguration categories plus granular SSRF classifications. • Adds Active Directory misconfiguration entries to the VRT, covering a new class of findings for AD-related vulnerabilities. • Adds Kerberos and SCCM abuse vectors as distinct VRT categories, enabling more precise classification of common internal attack paths. • Adds server security misconfiguration classifications rated across the full P1–P5 severity spectrum. • Replaces legacy SSRF categories with granular SSRF metrics, enabling finer-grained severity differentiation for server-side request forgery findings. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bugcrowd https://docs.bugcrowd.com/changelog/customers/ip-restrictions/ https://docs.bugcrowd.com/changelog/customers/ip-restrictions/ Thu, 14 May 2026 00:00:00 GMT IP Restrictions feature allows org admins to restrict access based on an IP allowlist • Adds IP Restriction configuration at the organization level to enforce access via an allowlist of approved IP addresses or CIDR ranges Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bugcrowd https://docs.bugcrowd.com/changelog/customers/cvss-v4/ https://docs.bugcrowd.com/changelog/customers/cvss-v4/ Wed, 29 Apr 2026 00:00:00 GMT CVSS Calculator adds CVSS 4.0 support with UI toggle and bulk API updates • `Program Settings > Submissions` now allows enabling CVSS 4.0 for new submissions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/bugcrowd