Bug bounty submissions

Identifies bug bounty and vulnerability disclosure programme (VDP) submissions - HackerOne, Bugcrowd, Intigriti, YesWeHack reports and researcher submissions - with report IDs, reproduction steps, affected endpoints and triage/bounty fields. General vulnerability reports are covered by global-vulnerability-assessment-report.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: programme wording is discovery-only; enforcement requires report IDs, reproduction steps, endpoints or triage fields, and 85 adds a second structure and a weakness class.
Detection quality: Topic false positive
Jurisdictions: global
Regulations: Criminal Code Act 1995 (Cth)
Frameworks: ISO 27001, NIST CSF
Data categories: security, technology
Scope: wide
Risk rating: 7
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:bug\s+bounty\s+(?:submission|report|triage|payout|award)s?|(?:HackerOne|Bugcrowd|Intigriti|YesWeHack)\s+(?:report|submission|triage)s?|(?:vulnerability|responsible)\s+disclosure\s+(?:submission|report)s?|VDP\s+(?:submission|report)s?|security\s+researcher\s+(?:submission|report)s?|bounty\s+(?:submission|payout|award)s?)\b

Corroborative evidence keywords

IDOR, SSRF, account takeover, proof of concept, SQL injection

Proximity: 300 characters

Should match

HackerOne report #2291047 - IDOR on invoice download (Harbourside Council VDP) Severity: high Triage status: triaged Steps to reproduce: 1. Sign in as ratepayer account A on https://portal.example.internal/account 2. Request GET /api/invoices/88412/pdf with account A's session 3. Observe invoice 88412 belongs to account B Impact: any ratepayer can download another ratepayer's invoice. — High tier (85) - report number, triage fields, reproduction steps and endpoints with an IDOR weakness
Bug bounty submission from an external researcher, report #55120 - closed as a duplicate of an earlier finding. — Medium tier (75) - report number only
Bugcrowd submission for the parking app - Bounty amount: $750 approved by the programme owner. — Medium tier (75) - bounty amount only
Finance approved the bug bounty payout budget for next financial year. — Discovery tier (65) - programme wording only

Should not match

The vulnerability report was sent to the vendor. — General vulnerability report wording is no longer a primary
Our security researcher presented at the conference. — Researcher mention without a submission
Vulnerability disclosure policy statement: researchers should use our VDP submission form and must not access customer data. — Policy text
Bug bounty report template Report #: ____ Severity: ____ Steps to reproduce: 1. ____ — Blank template
Media release: a researcher earned a record bug bounty award for an account takeover flaw; Severity: critical. — News framing

Known false positives

Public disclosure policies, security.txt pages and news about bug bounty awards. Mitigation: Programme wording is discovery-only; enforcement needs submission structure, and policy/news/template framing is excluded. Publicly disclosed reports copied from a platform can still enforce.