A Program Page You Can Point At
Scope groups, per-group reward tables, known issues and your safe harbor terms — on your own domain, in your own branding. Researchers read this before deciding whether to test you at all.
Reporters Need No Account
A magic link identifies a researcher and lets them follow their report. Nobody signs up, and a reporter never becomes a user of your workspace.
A Queue, Not an Inbox
Priority, duplicate suggestions from matching signatures, internal notes kept separate from what you send the reporter, and an append-only record of every decision — because the arguments a program has are all about that history.
The Promises Are Measured
Acknowledge in three days, assess in ten, publish after ninety: whatever you commit to becomes a clock on every report, so a commitment nobody measures is not one you miss in public.
Assign It To Security People
Program membership decides who works the queue, so security work does not require handing somebody the whole workspace. External contractors join as guests and see only their program.
Straight Into Your Tracker
An accepted report becomes an issue in Issue Tracking, or a bi-directional Jira ticket where resolving in Jira closes the report and tells the reporter. The report body deliberately stays put — a tracker is a wider audience than a triage team.