Change notes

The old account console has been retired. Everything it held now lives in settings, so /account goes straight there instead of showing a page whose only purpose was to tell you it had moved.

Your reviews came with it, with their status, at Settings → Your reviews. That page earns its place: editing a published review sends it back to review, and without somewhere to see that, an edit looks like a deletion.

The footer now uses the full width of the screen and is organised into columns rather than stranding a large gap in the middle of it.

Collaboration records existed, but there was no way to get from seeing another researcher to working with them. Now there is a button on their profile.

You can invite someone to a collaboration you already own, or start a new one in the same action. It becomes an ordinary invitation, and they accept or decline the way they always could.

Three things are built in on purpose. There is an opt-out, on your public profile settings, and when it is set the button does not appear and a hand-crafted request is refused. There is a limit of ten invitations a day, counted across every route so it cannot be side-stepped. And if someone declines, you cannot ask them again on that collaboration unless they come back to it themselves. A button on every profile is one small step from a way to pester people.

Apple's July releases are up: iOS 26.6, macOS Tahoe 26.6 and macOS Sequoia 15.7.8, 843 credits between them. 152 of those have no CVE at all — they are additional recognition, the kind of credit that until now had no identifier anywhere in the world. Every one of them now has a BugRater identifier, and every one of them is claimable.

They are on the home page as cards, and each release lists every line with search, filters and paging, because finding your own name among 376 should not mean scrolling. Filter to additional recognition, or to unclaimed lines only, and search by name, CVE or component.

Claiming opens a dialog that puts the vendor's credited name — exactly as they printed it — above everything else. That is deliberate: a claim is instant and public, so the check that it is really you has to be visible to anyone passing by. If you find a line already claimed, you can dispute it, and the person who claimed it gets to answer before a moderator decides.

These come in automatically now. A scheduled job reads Apple, Microsoft and Chrome security releases and files what it finds as drafts for review. Nothing a machine scrapes gets published without a human looking at it first.

Two fixes to credit claims, one of which mattered.

Restoring a rejected claim did not check whether the credit had been claimed by someone else in the meantime — and rejecting a claim is exactly what frees a credit up. One admin misclick could leave two people holding the same credit, with the release page showing whichever was older and quietly hiding the real holder. The restore now refuses, names who currently holds it, and does the check inside the update itself so there is no window between looking and writing.

Withdrawing a claim also used to be permanent, because nothing could re-claim the credit afterwards. That was survivable when claims waited for approval. Now that a claim is live the moment you make it, withdrawing takes a credit off your profile — so it can be restored.

Separately, the job scheduler no longer lives in the web root. The host runs it by file path, so it never needed to be reachable over the web, and a script that runs every scheduled job in the application is the last thing that should be. It now sits above the document root and refuses to run over HTTP at all.

Settings pages had drifted — two carried a title and two did not, so moving between sections looked like the page was rebuilding itself. They now share one header.

Also: a Preview profile button next to your avatar; the notification bell moved out of the row of text links and in with your account controls, where it reads as part of "you"; the masthead now uses the full width of the screen with the brand and actions in the corners; and adding a missing program moved to the top of the directory, since the directory will never be complete.

Two fixes with teeth. Link previews of the site were serving a stale social card, and the router had no handling for HEAD requests, so uptime monitors and every link unfurler saw a 404 on pages that were fine.

Background work now runs on a schedule that can be seen, paused, rescheduled and run by hand from the admin area, rather than living in a host control panel where nobody looks at it.

A job that is already running is never started twice, a job that fails is caught and reported without taking the rest down, and long jobs save their place and continue on the next tick instead of blocking everything behind them.

If you have verified a HackerOne account, you can now pull your public profile across instead of typing it again.

It is an itemised list, not a sync. Every row shows your current value, HackerOne's value, and a checkbox — nothing is applied that you did not tick, and an empty field on their side never clears a filled one on yours.

Alongside your details it brings your standing (reputation, rank, signal, impact, percentiles, streak, badges), the other platform handles you list there, and every program that has thanked you with your reputation and rank inside that program. Those get matched against our directory so you can go straight to writing a review.

Imported handles are marked as imported and unverified. HackerOne asserting your GitHub handle is corroboration, not proof.

Collaborations go wrong over attribution — who found the vector, who escalated it, what split was agreed, who submits. Those arguments happen months later, in private, with no record.

A collaboration record is that record: an append-only log attributed to whoever wrote each entry, and a split that binds only once every member has signed. Entries are never edited or deleted. A correction is a new entry, and both stay visible, which is the only reason the log is worth anything in a disagreement.

BugRater does not store your research. You hash your own finding in your browser and only the digest is sent, so revealing the text later proves what you held on that date and a breach of our database leaks nothing exploitable.

Leaving a collaboration does not erase your contributions, and you keep read-only access to the record.

A record of a disagreement, with both sides present.

Either a researcher or a verified program owner can open one. It opens private. The other side is notified and can reply, and nothing can be published until they have. Where no verified owner exists on the other side, a case cannot be published at all — a right of reply that nobody could exercise has not been honoured by letting a clock run out.

Categories are factual and evidence is asked for. Nothing here touches a BugBadge automatically; that is a human decision or it does not happen. Cases age out after two years, like most professional records.

Vendors publish their own security advisories, and those pages name the researcher in public. That is verifiable ground truth that no bounty platform controls — and it covers the work that is invisible everywhere else: open source, direct-to-vendor, and programs with no platform behind them.

Releases now have their own section. Each one lists every CVE and every named recognition in it, and you can claim your own line.

Every credit also gets a BugRater identifier — BR2026-0042-000137 — not just the ones a vendor happened to assign a CVE to. Additional recognition and acknowledgements have no identifier anywhere in the world. Now they have one, and it is yours to quote.

Anyone can dispute a claim, with a reason and an explanation. While a claim is disputed it reads as disputed and under review — never as fraudulent, never silently removed — and the person who claimed it is told and can answer before a moderator decides.

A review used to be one summary of a whole relationship with a program. Now every report you filed can be logged on its own row: month, severity, outcome, vulnerability class, asset type, bounty, time to first reply, whether you were credited — and, when it wasn't resolved, why it closed.

Filing a batch is the normal case, so the editor is built for it. Fill one row, then Duplicate last to reuse everything a batch to one program shares, and change only what differs.

The close reason comes from a fixed list of twenty-five, grouped as Scope, Impact, Evidence, Already known, and Process. They are written neutrally on purpose. "Already known internally" is not a complaint, and several of these are entirely reasonable positions for a program to take. The value is in the distribution, not in any single row.

Which is the point: program pages now show why reports get closed there, ranked. A grade tells you how a program felt to work with. This tells you what will get your report closed, which is the question that actually decides where a week of work goes. The panel only appears once a program has at least five public reports, and it is labelled as reported by researchers, not verified by us.

Your grade is unaffected. This records what happened; it does not re-score anything.

We're now BugRater, and moving to bugrater.com. The name says plainly what the platform does: researchers rate the programs they work. Everything you've built here — your profile, reviews, and reputation — comes with us unchanged.

The mobile menu and the leaderboard tables used to overflow their containers on small screens. Both are fixed: navigation now collapses cleanly and the ranking tables scroll and reflow properly on phones. The site is finally comfortable to use on mobile.

Account security caught up with the rest of the platform. You can now reset a forgotten password, verify your email address, and delete your account and its data whenever you want. These are table stakes for a site researchers trust, and they're now in place.

We built our own analytics instead of reaching for a third-party tracker. It's privacy-respecting by design: IP addresses are hashed, Do Not Track is honoured, and nothing is shared with outside services. We get the numbers we need to improve the platform without following anyone around the web.

There's now a read-only JSON API for programs, rankings, stats, and reviews. Access is key-authenticated, and each key comes with generated documentation — an api.md with your key already baked into the examples. You can pull our data into your own tooling in a few minutes.

You can now generate personalized invite links for researchers you want to bring in. Each link carries a custom landing page and tracks its own clicks and signups. It makes growing the community a deliberate, measurable thing rather than a broadcast.

Reviews are now a conversation. You can comment on them, share them with a clean link, and get notified when there's activity on your reviews or profile. It keeps you in the loop without having to check back manually.

A grade rarely tells the whole story. You can now publish a full write-up alongside a review — the context, the back-and-forth, and how it resolved. It gives other researchers the detail they need to decide whether a program is worth their time.

Reviews can now break down report by report, so the experience is documented at the level it actually happened. Each block has a public/private toggle: sensitive details can stay private while a dispute is arbitrated. That way disagreements get mediated fairly without airing everything in public first.

Every review now goes through one structured form, so a rating means the same thing across programs. From those answers we compute a letter grade, A+ down to F, and roll them up into a program scorecard. It makes programs directly comparable at a glance instead of buried in prose.

Researchers now have verified platform accounts on BugRater. You can import your HackerOne stats — reputation, rank, and signal — so your standing follows you here instead of starting from zero. Your review history lives on your profile, giving programs and peers an honest picture of who's rating them.