Community
Review guidelines
A good review helps another researcher decide where to spend their time. Reviews that follow these guidelines get published on BugRater faster. Reviews that don't are sent back or removed.
Write from first-hand experience
Only review a program you have worked on. Base your rating on your own submissions and interactions: triage speed, payout fairness, communication, scope honesty, and whether you'd submit again. Don't post secondhand rumors or things other people told you.
Be specific and fair
Specifics help: median time to first response, how a duplicate or scope dispute was handled, how the payout compared to the advertised range. Positive and negative reviews are both welcome. Fast, fair programs deserve credit as much as slow ones deserve a warning. Rate the experience you had.
Don't post sensitive details publicly
Protecting users comes first, and nothing else on this page overrides that. Do not post:
- Details of unpatched or unfixed vulnerabilities.
- Embargoed information or anything under a coordinated-disclosure timeline.
- The contents of a private report, or anything that would break an NDA or program terms.
- Anything that could help someone attack the program's users.
You can describe how a program handled a report without revealing what the report was.
You may tell us privately
The most useful thing on a program page is why reports get closed there. Explaining that well takes detail you must never publish, so we ask for it privately. Each report row in the review form has a Tell us privately panel with three questions:
- Which component or feature? A name, like checkout webhook.
- How did it work, in a sentence? Describe the technique and leave out the steps.
- What could an attacker actually do? The impact, in plain words.
Do not include a proof of concept, reproduction steps, or a payload. If someone could follow what you wrote, it is too much. Trim it or leave it blank. The panel is optional, the consent box is off until you tick it, and you can withdraw everything you have given us at any time from your reviews, which erases the text.
What we do with it
What you tell us never appears as your report. It only shows up as a number in a distribution that at least three reports contributed to. This is how we enforce that:
- Encrypted at rest. All three answers are encrypted with AES-256-GCM before they are written. The key is kept in the application's configuration. It is not in the database or in any table a query can reach, so a stolen database contains only ciphertext. GCM is authenticated, so if a value is tampered with, decryption fails outright.
- Limited access. You can read it from your reviews, where you can read back every word you gave us. Site moderators can read it when they are handling a dispute about a report, because they need it to mediate. No one else can, including the program, other researchers, and anyone browsing the site. We can read it, and we designed it that way, because that is what makes it useful when a program and a researcher disagree about what was filed.
- Published only as aggregates. A value is named on a program page once at least three reports from at least two different researchers share it. Both floors apply every time. Anything below either floor goes into an unnamed "too few to name" row. It is counted, so the totals add up, but it is never named. Five reports from one person still count as one researcher. A value in that row is never decrypted to build the page. It is counted by its encrypted token and stays encrypted.
- One facet at a time. We never cross-reference two private answers, or a private answer against a close reason. Two lists can each clear the floor while their intersection is a single report, and that is how people get identified from anonymised data. So we don't build the intersection at all.
- You can take it back. Withdraw it from your reviews and the text is erased. The encrypted value and the token used to count it are both deleted, and the program's numbers drop it on the next page load.
- It never affects a program's grade. The grade is computed from reviews. This data is only used for reporting.
Encryption at rest does not protect against someone who has compromised the application itself. Code that runs as us can use the key, the same way the site does when it shows you your own answers. That is the limit of this protection, and it is why the aggregate floors above are enforced in the query itself.
If it isn't fixed yet
Tick hold this back on that report. An embargoed row is left out of everything, including the component list and every total, until you come back and untick it. If you are unsure whether a fix has shipped, leave it ticked.
Your NDA and the program's terms still apply
Our asking does not override them, and we are a third party. If the program's terms, your NDA, or a platform's disclosure policy forbid sharing this with anyone outside the program, they forbid sharing it with us too. In that case, leave the panel blank. It costs you nothing, and a review with no private detail is still a good review.
No doxxing
Critique the program and its process. Don't publish private information about anyone, and don't name and target individual triagers or employees. "The triage team was slow to respond" is fair. Naming a specific person to attack them is not.
No astroturfing or retaliation
Companies may not rate their own programs, and no one may post fake positive reviews to inflate a grade. Likewise, don't post a retaliatory fake review to punish a program over an unrelated dispute. Both make the ratings less reliable for everyone.
What gets a review rejected
We decline reviews that aren't first-hand, disclose sensitive or embargoed details, break an NDA, name individuals, read as astroturfing or retaliation, or are abusive or spammy. Reviews from researchers who've verified a platform account carry more weight in a program's grade, so verifying your account makes your review count for more.
Keep it constructive
The goal is to help researchers choose where to spend their time. Write the clear, specific, fair review you would have wanted to read before you started.