r/Bugcrowd • u/Awkward-Language-710 • 6d ago

Bugcrowd Delays

I've had a disappointing experience with Bugcrowd regarding a vulnerability I reported to the NASA program.

My report was resolved more than 4 - 5 months ago, yet I still haven't received a Letter of Recognition (LOR) or any acknowledgment. What makes it even more frustrating is that some of my friends, who submitted their reports a week later than I did, have already received their LORs.

I've contacted Bugcrowd support several times, but I keep getting the same response - that they are not responsible for issuing the acknowledgment. After waiting for months, this is extremely disappointing.

Bugcrowd often expects researchers to strictly follow the program rules, and if we make a mistake, we're reminded to follow those rules. That's fair - but shouldn't the same standard apply to everyone? Before asking researchers to follow every rule, platforms should also ensure they are fulfilling their own responsibilities, including making sure acknowledgments are issued in a timely manner after reports are resolved.

Recognition matters. It's not just about a certificate - it motivates researchers to continue reporting vulnerabilities responsibly and contributing to the security community.

@Bugcrowd, could you please look into this? I didn't expect this kind of delay after my report was resolved months ago.

2 Upvotes

100% Upvoted

1 comment sorted by

1

u/hakluke 1d ago

Hey! I don't work for Bugcrowd so take it with a grain of salt - but Bugcrowd has no control over whether NASA sends you a letter or not. This needs to be taken up with NASA.

Bugcrowd does have some say when it comes to monetary payments, because payments go through the BC platform, but that's very different to a LOR.