Bugcrowd

Bugcrowd researchers have provided an excellent level of service building confidence that the most difficult to reach vulnerabilities are identified which enables our team to resolve and uplift controls in an efficient manner. I consider BugCrowd my most important security control as it addresses where we have the highest level of risk-our external attack surface.

At the end of Q2 2018 I contacted a sales rep at Bugcrowd to see if they were able to do a price cut to hit sales numbers. They obliged and gave me a great deal. The handoff to the Solutions Architect was smooth but soon after working with him I started to see the problems. I had very explicit scope I did not want tested. This scope was immediately ignored by the solutions architect and every single person I dealt with after. The scope was very explicit not to make new accounts, but to use the ones created for them. Multiple internal Bugcrowd employees ignored my request, and then followed by multiple researchers who had this scope explicit in their req. I let them know every time they didn’t follow this process, informing them it is not acceptable as they were entering our sales channels. I informed them if it continued to happen, that the benefit of using Bugcrowd would be outweighed by the negatives of researchers not following this outlined process. I then informed Bugcrowd if it continued to happen I will request a refund. The issue continued so I requested a pro-rated refund. I was denied and then was asked if I could do something on my end to prevent their process of not following directions. I informed Bugcrowd to pause the program because it doesn’t make sense for me to hardcode around their email addresses for their own lack of control and that the Bugcrowd platform from now moving forward has no use to me. Over the 5 months I have been using their program I did not see material results until month 4. In that month they were all very low priority bugs, some worth fixing, some not. I do not recommend their products if you want anything more than a rubber stamp of having a ‘bug bounty program.’