How Bugb coordinates responsible disclosure

We run an evidence‑first process that protects users and helps engineering teams move fast. Researchers use CERT‑X‑GEN and Telemetry Ingest to validate findings in a sandbox, generate reproducible PoCs, and auto‑assemble an evidence pack (PDF/JSON). The report is routed via Apollo to the right owners and delivered through the BKeeper external inbox with signed email (PGP), headers, and a secure portal link for collaboration.

• 90‑day coordinated timeline with extensions when needed
• Safe‑harbor for good‑faith research; zero data‑exfil posture
• PGP‑signed notifications, SPF/DKIM, full audit trail
• Auto‑generated artifacts: DisclosureReport.pdf, PoC template, portal link
• Triage → fix → re‑verify in CERT‑X‑GEN → acknowledge
• Optional CVE request & Hall‑of‑Fame credit on publish

This bridges researchers and organizations inside one control plane, cutting false positives, accelerating time‑to‑fix, and ensuring issues are reproduced, remediated, and publicly acknowledged responsibly.