BugBase Security services
Bug bounty programs, managed end to end.
Security researchers test your apps. Our team triages what they report, talks to them for you and pays their bounties, so your engineers only see real, reproducible issues.
Already run a program with us? Log in
Choose how open your program is
Every program runs on the same platform and the same triage team. What changes is who can test and whether you pay rewards.
Public bug bounty
Your scope is listed for researchers on BugBase. You pay for valid findings, at the reward you set for each group of assets.
Private bug bounty
Invite-only: you choose who tests it. Suits staging, apps behind a login and first tests of production, and you hand out test credentials from a vault.
Vulnerability disclosure program
A safe, public way for anyone to report a security issue, following the ISO/IEC 29147 disclosure model. Rewards are optional.
Who does what
You decide what gets tested and fix what matters. We run everything in between.
Your team
- Sets the scope and the reward for each group of assets.
- Approves bounties, if you want a sign-off step.
- Fixes the issues we confirm.
BugBase
- Triages every report: our in-house team, working manually with AI assistance.
- Rejects invalid and duplicate reports, with the reason, so researchers stay engaged.
- Sets severity with CVSS and our vulnerability rating taxonomy.
- Handles the conversation with researchers for you.
- Checks researcher identity (PAN, Aadhaar or passport) before anyone is paid.
- Pays researchers, so you never process invoices from individual hackers.
- Checks that a fix holds once you ship it.
Fits how your team works
- Internal and staging apps
- Researchers reach apps that aren't public through the BugBase VPN, with rate, location and time-zone limits you set.
- Spend and severity in one place
- A dashboard shows findings by severity and what your program has paid out.
- Findings where you already work
- Send reports to Jira, Linear, GitHub, Asana, Slack, Microsoft Teams, PagerDuty or Sumo Logic, or to your own webhook.
BugBase strengthened our security posture with its ethical hacker community and streamlined bug tracking. Real-time notifications and seamless collaboration boost efficiency. Kudos to BugBase's excellent support team for prompt assistance.
Add Pentest Copilot alongside your researchers
Run Pentest Copilot's AI agents on your bounty scope alongside your researchers, and pay your own reward table only for bugs they prove.
Questions
Who tests a private program?
Only researchers you invite. You can also open it to BugBase Apollo, a community of researchers our team admits on skill and track record. Researchers verify their identity with PAN, Aadhaar or passport before they are paid.
Can we invite specific researchers?
Yes. Invite them by email or BugBase username, or send an invite link with a use limit and expiry that you can revoke at any time.
Who pays the researchers?
We do. You fund the program and approve rewards for valid reports; BugBase pays the researcher, so you don't handle invoices or payouts to individuals.
Do we have to talk to researchers ourselves?
No. Our triage team handles the conversation. You can still read and reply on any report.
How is it priced?
It depends on the program type and the scope you want covered. Tell us what you want tested and we'll send pricing.
Where can our vendor-risk team find your security documents?
On our Trust Center at trust.bugbase.ai.
What's the difference between a disclosure program and a bug bounty?
A disclosure program gives anyone a safe way to report a security issue, without promising a reward. A bug bounty pays for valid findings. Many teams start with disclosure and add rewards later.
Tell us what you want tested, and we'll set the program up with you.
