Our commitments

What we will and won't do

A ratings site ends up holding a record of people's reputations and some influence over where they spend their time. If we're vague about how we handle either, you have no reason to trust the grades or the credentials attached to them. So we've written the rules down. These are our founding commitments, and we expect to be held to them as BugRater grows and as we roll out BugBadge, a portable researcher credential. A BugBadge attests to a track record. It does not attest to a legal identity.

Two rules we won't break. We do not collect or store government-issued ID (passport, driver's licence, or national ID). We do not handle the money. Bounties are paid directly between the researcher and the program, and we hold no funds and take no cut.

No government ID

BugRater does not collect, require, or store government-issued identification, such as a passport, driver's licence, or national ID. We will not introduce it later. Your standing here comes from verified platform accounts and a public track record. We don't ask who you are offline.

ID requirements lock out people who often have the most to offer: researchers who work under a handle, people in countries where the accepted documents are hard to obtain, and anyone who won't hand a private company their ID for operational-security reasons. A BugBadge lets a pseudonymous researcher with a real record carry that record anywhere without revealing who they are.

We don't handle money

Bounties are paid directly between the researcher and the program. BugRater is not an escrow, a payment processor, a broker, or a party to any disclosure or settlement. We take no cut of a bounty and we hold no funds at any point.

Platforms that move money end up needing banking details and identity documents to do it. Once they hold those, they face constant pressure to verify who you are. Staying out of payments makes the no-ID commitment above easy for us to honour.

Grades and badges are not guarantees

A BugBadge, a letter grade, and a review are all evidence to weigh. None of them guarantees anything about a person or a program. A badge says a researcher had a verifiable track record at a point in time. It does not promise how they'll behave on your program. A grade summarises reported experiences. It does not certify how a program will behave in future.

Programs remain fully responsible for their own triage decisions. A badge is context. It is not a hiring guarantee or a reason to skip your own process. Researchers remain responsible for their own conduct and for honouring the disclosure rules of the programs they work with. We provide the information and do not guarantee any outcome.

Good reviews and bad ones

We publish good experiences with the same prominence as bad ones, through one standardized form. That way a grade means the same thing for every program, and a fast, fair program gets credit for it.

You own your reputation

The record you build here is yours. It's portable (a BugBadge is meant to travel with you to other sites), exportable, and deletable. If you delete your account, your reputation on BugRater goes with it. We won't use your standing to keep you on the platform.

Checking our record

Changes to how the platform works are recorded in our change notes, so you can check whether any of these principles has changed. If you think we've broken one of them, tell us at hello@bugrater.com.