NEWBravos is availableCreate your account
Bugb Logo
Menu

The Bugb responsible disclosure pledge@mitigates <asset> against <threat> [using <control>]Records that a control mitigates a threat on an asset, which closes the exposure.@mitigates in the GuardLink reference

We report what we find, privately and with evidence, before attackers find it.

We look for vulnerabilities in organisations' public exposure and validate each one in a sandbox. Then we tell the owner privately, with the evidence, and the organisation fixes it.

Request disclosure

How a disclosure runs

  1. FindA CXG template matches something in the organisation's public exposure.
  2. Validate in a sandboxWe reproduce it safely and capture the evidence.
  3. Report privately, with evidenceThe report goes to the owner, not to the public.
  4. Coordinate the fixWe work with the organisation until the fix is confirmed.
  5. Publish togetherAnything public, credit included, comes only after the fix ships.

Public credits

CVE records where the vendor's advisory credits a Bugb researcher.

Coordinated disclosures in progress with Portainer. Read the case study on the advisories published so far.

Acknowledged our vulnerability reports

33 organisations

  • IBM
  • Dell
  • Philips
  • Volkswagen
  • Fortinet
  • MIT
  • Portainer
  • Temporal
  • Mattermost
  • Axway
  • Fortanix
  • GeoComply
  • Ruckus
  • AccelByte
  • Tyler Technologies
  • SafetyPay
  • Kine
  • Keepnet Labs
  • KickEX
  • Latitude
  • CATAX
  • Claro
  • Divante
  • GoStream
  • Ambee
  • Adtelligent
  • Ausmed
  • CHRMP
  • Imredi
  • InRange
  • SafeGold
  • Zigram
  • ZStack

Organisations that acknowledged vulnerabilities we reported. Not clients, and not endorsements.

What teams said after a report

  • “The vulnerability was reported to IBM by Shahid Parvez (zippon).”

    IBMSecurity bulletin for CVE-2023-27290

    Source
  • “Fortinet is pleased to thank Vang3lis and Cyth from VARAS@IIE and Shahid Parvez Hakim CEO & Founder of Bugb Technologies (bugb.io)…”

    FortinetPSIRT advisory FG-IR-24-339

    Source
  • “We sincerely thank Bugb Technologies for responsibly reporting an information disclosure vulnerability. Your professional coordination helped us accelerate remediation.”

    AxwayGlobal Director, Software Security

  • “Thank you for the responsible report. Our Security & Safety unit is collaborating directly with Bugb to drive timely mitigation.”

    TomTomInfrastructure Security

  • “We appreciate Bugb for identifying and responsibly reporting a vulnerability. Your insights are directly informing our fixes.”

    AmbeeEngineer

  • “We've logged the finding and begun a coordinated assessment with the right owners.”

    PaysendGroup CISO

Request responsible disclosure

For an organisation that wants us to check its public exposure and report what we find, privately. We verify that you're responsible for the domain, so give a work email or a LinkedIn profile.

Found a vulnerability in a Bugb product? Report it under our vulnerability disclosure policy instead.