Jekyll2026-09-16T05:46:36+00:00https://docs.bugcrowd.com/changelog.xmlBugcrowd user documentation2026-09-06T00:00:00+00:002026-09-06T00:00:00+00:00https://docs.bugcrowd.com/changelog/customers/linking-vulnerability-detections-to-jira<p>Customers with the Jira integration enabled can now link and push <strong>Vulnerability Detections</strong> (surfaced in the Security Inbox from continuous scanning) to Jira issues, in addition to submissions. This keeps remediation work tracked in Jira in sync with the risk data in Crowdcontrol.</p> <p>From a Vulnerability Detection’s <strong>Integrations</strong> panel, use <strong>Push</strong> to create a new Jira issue populated with the detection’s details, or <strong>Link</strong> to connect it to an existing Jira issue. Once linked, updates can be pushed to Jira, comments stay in sync, and the link can be edited or removed at any time.</p> <div class="uk-alert-primary" data-uk-alert=""><p>Jira integration must already be configured for your organization before you can link a Vulnerability Detection to Jira. Automated creation rules and attachment syncing currently apply to submissions only.</p> </div> <p>For full details, see <a href="/customers/integration-management/jira/linking-vulnerability-detections-to-jira/">Linking a Vulnerability Detection to Jira</a>.</p>

Customers with the Jira integration enabled can now link and push Vulnerability Detections (surfaced in the Security Inbox from continuous scanning) to Jira issues, in addition to submissions. This keeps remediation work tracked in Jira in sync with the risk data in Crowdcontrol.

2026-08-25T00:00:00+00:002026-08-25T00:00:00+00:00https://docs.bugcrowd.com/changelog/researchers/rar-expiration-removal<h2 id="request-a-response-rar-your-requests-no-longer-expire">Request a Response (RaR): Your requests no longer expire</h2> <p>We’ve updated how Request a Response (RaR) works. Open RaRs no longer expire after a fixed period. Your request now stays open until it is resolved, so it will no longer be closed automatically before you receive an answer.</p> <p>What this means for you:</p> <ul> <li>There is no longer a countdown or expiry timer on your RaRs.</li> <li>Each RaR shows the date it was created, so you can track how long it has been open.</li> <li>As before, when one of your open RaRs is resolved, it frees up 1 active account slot allowing you to open a new RaR, but permanently counts as 1 of your 2 allowed requests for the specific submission.</li> </ul> <p>All RaR activity continues to be recorded in the submission’s Activity.</p>

Request a Response (RaR): Your requests no longer expire

2026-08-25T00:00:00+00:002026-08-25T00:00:00+00:00https://docs.bugcrowd.com/changelog/customers/rar-expiration-removal<h2 id="request-a-response-rar-requests-no-longer-expire-plus-new-inbox-filters">Request a Response (RaR): Requests no longer expire, plus new inbox filters</h2> <p>We’ve updated how Request a Response (RaR) works. Open RaRs no longer expire automatically after a fixed period. Each RaR now stays open until your team responds or resolves it, so a researcher’s request will not close on its own before it is answered.</p> <p>What this means for you:</p> <ul> <li>There is no longer a countdown or expiry timer on an RaR.</li> <li>Each RaR shows the date it was raised, so you can see how long it has been open.</li> <li>New inbox filters let you view requests by status: select “Active requests to Customers” to quickly find what needs your attention or “Resolved requests to Customers” to see those already handled.</li> <li>We encourage responding to open RaRs promptly to keep submissions moving and maintain positive researcher engagement.</li> </ul> <p>No action is required. All RaR activity continues to be recorded in the submission’s Activity for transparency.</p>

Request a Response (RaR): Requests no longer expire, plus new inbox filters

2026-08-25T00:00:00+00:002026-08-25T00:00:00+00:00https://docs.bugcrowd.com/changelog/customers/generating-vulnerability-detection-report<p>Bugcrowd customers can now generate a Vulnerability Detection Report at the organization level. The report is delivered as a PDF summarizing vulnerability detections found across your organization’s assets, scoped by date range, CVSS severity, and asset filters, and grouped either by asset or by vulnerability.</p> <div class="uk-alert-primary" data-uk-alert=""><p><strong>Note</strong>: The Vulnerability Detection Report is only available when Asset Inventory is enabled for your organization and your organization has an active vulnerability scan configured.</p> </div> <p><img src="/assets/images/customer/vulnerability-detection-report/configure-report.png" alt="create vulnerability detection report" /></p>

Bugcrowd customers can now generate a Vulnerability Detection Report at the organization level. The report is delivered as a PDF summarizing vulnerability detections found across your organization’s assets, scoped by date range, CVSS severity, and asset filters, and grouped either by asset or by vulnerability.

2026-08-17T00:00:00+00:002026-08-17T00:00:00+00:00https://docs.bugcrowd.com/changelog/customers/pathseeker-early-access<p>Savant Pathseeker is now available in Early Access for autonomous penetration testing. The documentation suite has been updated to support onboarding and day-to-day use, including a new overview article covering core capabilities and product scope, step-by-step guidance for launching an autonomous test, adding assets mid-setup, running authenticated tests behind login (including external identity providers), and pushing validated findings to the Security Inbox.</p>

Savant Pathseeker is now available in Early Access for autonomous penetration testing. The documentation suite has been updated to support onboarding and day-to-day use, including a new overview article covering core capabilities and product scope, step-by-step guidance for launching an autonomous test, adding assets mid-setup, running authenticated tests behind login (including external identity providers), and pushing validated findings to the Security Inbox.

2026-07-14T00:00:00+00:002026-07-14T00:00:00+00:00https://docs.bugcrowd.com/changelog/customers/savant-vista-public-beta<p>Savant Vista is now available in Public Beta for asset discovery and vulnerability scanning. The documentation suite has been updated to support onboarding and day-to-day use, including a new overview article covering core concepts and product scope, step-by-step how-to guides for estate discovery, vulnerability baseline setup, and launching an autonomous test, and updated detailed reference articles reflecting the current platform UI, asset model, and scan behavior.</p>

Savant Vista is now available in Public Beta for asset discovery and vulnerability scanning. The documentation suite has been updated to support onboarding and day-to-day use, including a new overview article covering core concepts and product scope, step-by-step how-to guides for estate discovery, vulnerability baseline setup, and launching an autonomous test, and updated detailed reference articles reflecting the current platform UI, asset model, and scan behavior.

2026-07-08T00:00:00+00:002026-07-08T00:00:00+00:00https://docs.bugcrowd.com/changelog/customers/vrt-update-119<p>Bugcrowd’s Vulnerability Rating Taxonomy (VRT) has been expanded to include Active Directory (AD) misconfigurations, Kerberos/SCCM abuse vectors, and server security misconfigurations (P1–P5). SSRF classifications have also been streamlined by replacing legacy categories with more granular SSRF metrics.</p>

Bugcrowd’s Vulnerability Rating Taxonomy (VRT) has been expanded to include Active Directory (AD) misconfigurations, Kerberos/SCCM abuse vectors, and server security misconfigurations (P1–P5). SSRF classifications have also been streamlined by replacing legacy categories with more granular SSRF metrics.

2026-05-18T00:00:00+00:002026-05-18T00:00:00+00:00https://docs.bugcrowd.com/changelog/researchers/verifying-your-identity<p>Identity verification (IDV) is now required for all researchers prior to submitting reports to Managed Bug Bounty (MBB) programs — both public and private (excluding on-demand MBBs). This change strengthens platform integrity by reducing high volumes of low-quality submissions originating from newly created or rotating accounts. Verification requires researchers to complete a live selfie capture via webcam and upload a valid government-issued ID (passport, identity card, or driver’s license) through an embedded portal accessible directly from Account Settings under the Identity Verification tab. Researchers who have previously completed IDV — including those verified for payments or background checks — do not need to re-verify. The process supports multi-nationality verification and allows up to five attempts before a support ticket is required. For more information, visit <a href="https://docs.bugcrowd.com/researchers/managing-account/account-settings/verifying-your-identity/">Verifying Your Identity</a>.</p>

Identity verification (IDV) is now required for all researchers prior to submitting reports to Managed Bug Bounty (MBB) programs — both public and private (excluding on-demand MBBs). This change strengthens platform integrity by reducing high volumes of low-quality submissions originating from newly created or rotating accounts. Verification requires researchers to complete a live selfie capture via webcam and upload a valid government-issued ID (passport, identity card, or driver’s license) through an embedded portal accessible directly from Account Settings under the Identity Verification tab. Researchers who have previously completed IDV — including those verified for payments or background checks — do not need to re-verify. The process supports multi-nationality verification and allows up to five attempts before a support ticket is required. For more information, visit Verifying Your Identity.

2026-05-14T00:00:00+00:002026-05-14T00:00:00+00:00https://docs.bugcrowd.com/changelog/customers/ip-restrictions<p>The IP Restrictions feature allows organization admins to restrict access to their organization based on IP address. By configuring an allowlist, you can ensure that only users connecting from approved IP addresses or CIDR ranges are able to access data within the organization.</p> <p>This setting is configured at the organization level and applies to all admin users associated with that organization.</p>

The IP Restrictions feature allows organization admins to restrict access to their organization based on IP address. By configuring an allowlist, you can ensure that only users connecting from approved IP addresses or CIDR ranges are able to access data within the organization.

2026-05-05T00:00:00+00:002026-05-05T00:00:00+00:00https://docs.bugcrowd.com/changelog/api/api-version-1.1.0<p>See the full <a href="https://docs.bugcrowd.com/api/1.1.0/">API Version 1.1.0 reference</a> for request/response details.</p> <h2 id="funding_pool-include-on-monetary-rewards"><code class="language-plaintext highlighter-rouge">funding_pool</code> include on monetary rewards</h2> <p>Added <code class="language-plaintext highlighter-rouge">funding_pool</code> as an includable relationship on the monetary reward endpoint. Use <code class="language-plaintext highlighter-rouge">include=funding_pool</code> to retrieve the funding pool associated with a monetary reward in a single request.</p> <h2 id="last_activity_feed_item_created_at-filter-on-the-submissions-index"><code class="language-plaintext highlighter-rouge">last_activity_feed_item_created_at</code> filter on the submissions index</h2> <p>Added <code class="language-plaintext highlighter-rouge">filter[last_activity_feed_item_created_at]</code> query parameter to the submissions index endpoint. This allows filtering submissions by the timestamp of their last activity feed item.</p> <h2 id="active_blocker-include-on-submissions"><code class="language-plaintext highlighter-rouge">active_blocker</code> include on submissions</h2> <p>Added <code class="language-plaintext highlighter-rouge">active_blocker</code> as an includable relationship on the submission endpoint. Use <code class="language-plaintext highlighter-rouge">include=active_blocker</code> to retrieve the active blocker for a submission in a single request.</p> <h2 id="active_researcher_request_response-include-on-submissions"><code class="language-plaintext highlighter-rouge">active_researcher_request_response</code> include on submissions</h2> <p>Added <code class="language-plaintext highlighter-rouge">active_researcher_request_response</code> as an includable relationship on the submission endpoint. Use <code class="language-plaintext highlighter-rouge">include=active_researcher_request_response</code> to retrieve the active researcher request response for a submission in a single request.</p> <h2 id="credential-bucket-endpoints">Credential bucket endpoints</h2> <p>Added credential bucket endpoints. Credential buckets allow programs to manage pools of credentials for researchers to use during testing.</p> <h2 id="credential-endpoints">Credential endpoints</h2> <p>Added credential endpoints. Credentials represent individual login credentials within a credential bucket that can be assigned to researchers.</p> <h2 id="post-submissionssearch-endpoint">POST <code class="language-plaintext highlighter-rouge">/submissions/search</code> endpoint</h2> <p>Added a POST endpoint for searching submissions with a JSON request body. Accepts filter, sort, page, include, and fields parameters in the body, avoiding URL length limitations for complex queries.</p>

See the full API Version 1.1.0 reference for request/response details.