bugcrowd-reporting

Name: bugcrowd-reporting
Author: elementalsouls

3.0kstars461forks

How to install bugcrowd-reporting?

elementalsouls/claude-bughunter/bugcrowd-reporting

$npx -y skills add elementalsouls/Claude-BugHunter --skill bugcrowd-reporting

Installs into the current project.

Summary

Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severity override when VRT defaults underrate impact, severity-request paragraph as first body section, OOS-clause rebuttal templates (ra

Files · 1

View on GitHub

SKILL.md

1	# BUGCROWD REPORTING — Program-Specific Tactics
2
3	> Companion to the generic `report-writing` skill. Use when working specifically on Bugcrowd submissions where VRT mapping, OOS-clause rebuttals, or per-program target selection matter.
4
5	This skill encodes patterns that apply specifically to Bugcrowd's submission flow. For the generic per-platform templates (HackerOne / Bugcrowd / Intigriti / Immunefi report bodies), use the `report-writing` skill. For the 7-Question Gate before deciding to report at all, use `triage-validation`.
6
7	---
8
9	## 1. VRT Category Selection — Search & Fallback Strategy
10
11	Bugcrowd's submission form requires a single VRT (Vulnerability Rating Taxonomy) selection. The dropdown's default severity is bound to the chosen node — pick wrong and the form auto-suggests a lower priority (often P4) when the actual impact is P3 or P2.
12
13	> Note: VRT default severities are not fixed constants. Bugcrowd revises the VRT schema across versions, and individual programs can remap defaults via their own priority configuration. The P-values shown in the examples below (e.g., "No Rate Limiting on Form → Login" defaulting to P4) are the typical baseline at time of writing — always read the severity the current form actually auto-suggests for this program rather than assuming the value here.
14
15	### 1.1 Search hierarchy (try in order, pick the highest-severity match that still describes the bug)
16
17	For any finding, search the VRT dropdown with these terms in this order:
18
19	1. The bug's primary class — e.g., `IDOR`, `XSS`, `SSRF`, `auth bypass`, `2FA bypass`
20	2. The data category exposed — e.g., `PII`, `sensitive data exposure`, `disclosure of secrets`
21	3. The control bypassed — e.g., `broken access control`, `authentication bypass`
22	4. The endpoint type — e.g., `no rate limiting on form > login`, `no rate limiting on form > change password`
23	5. The generic parent node — e.g., `Server Security Misconfiguration > Other`, `Broken Access Control > Other`
24
25	### 1.2 Pick the highest-severity match that still accurately describes the bug
26
27	Never select a VRT that misrepresents the bug just to get a higher default severity. Triagers will reassign and may flag the misrepresentation. The discipline is: pick the most specific accurate VRT, then use §2 (Manual Severity Override) if the default is wrong.
28
29	### 1.3 Common mappings worth knowing
30
31	\| Finding type \| First-choice VRT \| Fallback \|
32	\|---\|---\|---\|
33	\| ATO via missing 2FA on password change \| Broken Authentication & Session Management → Second Factor Authentication (2FA/MFA) → Bypass \| Broken Auth → Authentication Bypass → Other \|
34	\| Password oracle without rate limit \| Broken Authentication & Session Management → Authentication Bypass → Other \| Server Security Misconfiguration → No Rate Limiting on Form → Login \|
35	\| GraphQL introspection / APQ allowlist bypass \| Server Security Misconfiguration → Other (justify in body) \| Broken Access Control → Other \|
36	\| Username → real name PII enumeration \| Sensitive Data Exposure → PII Leakage / Disclosure of Secrets → Non-Corporate User \| Broken Access Control → Other \|
37	\| State desync on security-sensitive action \| Application-Level DoS → Other (with state-desync framing) \| Server Security Misconfiguration → Other \|
38	\| Email/SMS pumping on auth-flow endpoint \| Server Security Misconfiguration → No Rate Limiting on Form → Email-Triggering / SMS-Triggering \| Server Security Misconfiguration → No Rate Limiting on Action \|
39	\| Token brute-force (email-change OTP, password reset) \| Broken Authentication → Authentication Bypass → Other \| Server Security Misconfiguration → No Rate Limiting on Action \|
40
41	### 1.4 If no good VRT exists
42
43	Pick `Server Security Misconfiguration → Other` or `Broken Access Control → Other` and lead the description body with a "VRT mapping note" explaining why the chosen node is the closest available match and what the bug actually is.
44
45	---
46
47	## 2. Manual Severity Override
48
49	Bugcrowd's form lets you manually set Technical Severity separate from the VRT default. The form text itself states: *"A severity rating suggested by the VRT i

People who liked this also viewed

6 picks

Type

bugcrowd-reporting

3.0kstars461forks

View on GitHub

How to install bugcrowd-reporting?

elementalsouls/claude-bughunter/bugcrowd-reporting

$npx -y skills add elementalsouls/Claude-BugHunter --skill bugcrowd-reporting

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# BUGCROWD REPORTING — Program-Specific Tactics
2
3	> Companion to the generic `report-writing` skill. Use when working specifically on Bugcrowd submissions where VRT mapping, OOS-clause rebuttals, or per-program target selection matter.
4
5	This skill encodes patterns that apply specifically to Bugcrowd's submission flow. For the generic per-platform templates (HackerOne / Bugcrowd / Intigriti / Immunefi report bodies), use the `report-writing` skill. For the 7-Question Gate before deciding to report at all, use `triage-validation`.
6
7	---
8
9	## 1. VRT Category Selection — Search & Fallback Strategy
10
11	Bugcrowd's submission form requires a single VRT (Vulnerability Rating Taxonomy) selection. The dropdown's default severity is bound to the chosen node — pick wrong and the form auto-suggests a lower priority (often P4) when the actual impact is P3 or P2.
12
13	> Note: VRT default severities are not fixed constants. Bugcrowd revises the VRT schema across versions, and individual programs can remap defaults via their own priority configuration. The P-values shown in the examples below (e.g., "No Rate Limiting on Form → Login" defaulting to P4) are the typical baseline at time of writing — always read the severity the current form actually auto-suggests for this program rather than assuming the value here.
14
15	### 1.1 Search hierarchy (try in order, pick the highest-severity match that still describes the bug)
16
17	For any finding, search the VRT dropdown with these terms in this order:
18
19	1. The bug's primary class — e.g., `IDOR`, `XSS`, `SSRF`, `auth bypass`, `2FA bypass`
20	2. The data category exposed — e.g., `PII`, `sensitive data exposure`, `disclosure of secrets`
21	3. The control bypassed — e.g., `broken access control`, `authentication bypass`
22	4. The endpoint type — e.g., `no rate limiting on form > login`, `no rate limiting on form > change password`
23	5. The generic parent node — e.g., `Server Security Misconfiguration > Other`, `Broken Access Control > Other`
24
25	### 1.2 Pick the highest-severity match that still accurately describes the bug
26
27	Never select a VRT that misrepresents the bug just to get a higher default severity. Triagers will reassign and may flag the misrepresentation. The discipline is: pick the most specific accurate VRT, then use §2 (Manual Severity Override) if the default is wrong.
28
29	### 1.3 Common mappings worth knowing
30
31	\| Finding type \| First-choice VRT \| Fallback \|
32	\|---\|---\|---\|
33	\| ATO via missing 2FA on password change \| Broken Authentication & Session Management → Second Factor Authentication (2FA/MFA) → Bypass \| Broken Auth → Authentication Bypass → Other \|
34	\| Password oracle without rate limit \| Broken Authentication & Session Management → Authentication Bypass → Other \| Server Security Misconfiguration → No Rate Limiting on Form → Login \|
35	\| GraphQL introspection / APQ allowlist bypass \| Server Security Misconfiguration → Other (justify in body) \| Broken Access Control → Other \|
36	\| Username → real name PII enumeration \| Sensitive Data Exposure → PII Leakage / Disclosure of Secrets → Non-Corporate User \| Broken Access Control → Other \|
37	\| State desync on security-sensitive action \| Application-Level DoS → Other (with state-desync framing) \| Server Security Misconfiguration → Other \|
38	\| Email/SMS pumping on auth-flow endpoint \| Server Security Misconfiguration → No Rate Limiting on Form → Email-Triggering / SMS-Triggering \| Server Security Misconfiguration → No Rate Limiting on Action \|
39	\| Token brute-force (email-change OTP, password reset) \| Broken Authentication → Authentication Bypass → Other \| Server Security Misconfiguration → No Rate Limiting on Action \|
40
41	### 1.4 If no good VRT exists
42
43	Pick `Server Security Misconfiguration → Other` or `Broken Access Control → Other` and lead the description body with a "VRT mapping note" explaining why the chosen node is the closest available match and what the bug actually is.
44
45	---
46
47	## 2. Manual Severity Override
48
49	Bugcrowd's form lets you manually set Technical Severity separate from the VRT default. The form text itself states: *"A severity rating suggested by the VRT i

People who liked this also viewed

6 picks

Type