# Bugcrowd Reporting

Bugcrowd-specific reporting tactics complementing report-writing: VRT category...

- Repository: https://github.com/elementalsouls/Claude-BugHunter (5368 stars)
- Category: Testing
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add elementalsouls/Claude-BugHunter --skill bugcrowd-reporting -g -a claude-code -y`
Codex: `npx skills add elementalsouls/Claude-BugHunter --skill bugcrowd-reporting -g -a codex -y`
Cursor: `npx skills add elementalsouls/Claude-BugHunter --skill bugcrowd-reporting -g -a cursor -y`
Gemini CLI: `npx skills add elementalsouls/Claude-BugHunter --skill bugcrowd-reporting -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add elementalsouls/Claude-BugHunter`

## Description

Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severity override when VRT defaults underrate impact, severity-request paragraph as first body section, OOS-clause rebuttal templates (rate limiting on auth-flow endpoints, debug-info framing, user-enumeration with sensitive PII, theoretical-issue counter), chained-finding cross-reference patterns, target selection for QA-vs-prod programs, researcher-side hygiene (Bugcrowdninja email alias, account state restoration, friendly-tester posture). Use when filing a Bugcrowd submission, when VRT default seems wrong, when triager closes as OOS or downgrades severity, when chaining linked submissions, or when scope distinguishes production from QA. Pairs with report-writing and triage-validation.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# BUGCROWD REPORTING, Program-Specific Tactics

> Companion to the generic `report-writing` skill. Use when working specifically on Bugcrowd submissions where VRT mapping, OOS-clause rebuttals, or per-program target selection matter.

This skill encodes patterns that apply specifically to Bugcrowd's submission flow. For the generic per-platform templates (HackerOne / Bugcrowd / Intigriti / Immunefi report bodies), use the `report-writing` skill. For the 7-Question Gate before deciding to report at all, use `triage-validation`.

---

## 1. VRT Category Selection, Search & Fallback Strategy

Bugcrowd's submission form requires a single VRT (Vulnerability Rating Taxonomy) selection. The dropdown's default severity is bound to the chosen node, pick wrong and the form auto-suggests a lower priority (often P4) when the actual impact is P3 or P2.

> Note: VRT default severities are not fixed constants. Bugcrowd revises the VRT schema across versions, and individual programs can remap defaults via their own priority configuration. The P-values shown in the examples below (e.g., "No Rate Limiting on Form → Login" defaulting to P4) are the typical baseline at time of writing, always read the severity the *current* form actually auto-suggests for *this* program rather than assuming the value here.

### 1.1 Search hierarchy (try in order, pick the highest-severity match that still describes the bug)

For any finding, search the VRT dropdown with these terms in this order:

1. **The bug's primary class**, e.g., `IDOR`, `XSS`, `SSRF`, `auth bypass`, `2FA bypass`
2. **The data category exposed**, e.g., `PII`, `sensitive data exposure`, `disclosure of secrets`
3. **The control bypassed**, e.g., `broken access control`, `authentication bypass`
4. **The endpoint type**, e.g., `no rate limiting on form > login`, `no rate limiting on form > change password`
5. **The generic parent node**, e.g., `Server Security Misconfiguration > Other`, `Broken Access Control > Other`

The rest: https://github.com/elementalsouls/Claude-BugHunter/blob/HEAD/skills/bugcrowd-reporting/SKILL.md