Any intake channel
security.txt-advertised inboxes, custom submission forms, Jira/Linear/GitHub issues. If reports land somewhere, we can work them there.
Works with Self-hosted programs
Expert triage for self-hosted programs.
Plenty of strong programs run on a security@ inbox, a web form and a wiki page. We plug into whatever you've built (shared inbox, ticketing system, custom tracker, or a plain mailbox) and run the same reproduce-first process we run everywhere else.
Structure from chaos
Self-hosted intake means free-text emails with screenshots. We convert them into structured, deduplicated, severity-rated reports your engineers can act on.
Researcher correspondence
We draft or send the responses (acknowledgements, clarifying questions, verdicts) under your program's identity and tone.
A paper trail
Every verdict is documented with evidence and reasoning, giving your self-hosted program the audit trail platforms provide out of the box.
FAQ
Common questions about Self-hosted programs triage.
We only have a VDP, no bounties. Is that fine? +
Completely. Disclosure-only programs still drown in noise (arguably more, since there's no submission friction). Triage effort is the same either way.
How do you access our inbox? +
However you prefer: delegate access to a shared mailbox, an account in your ticketing system, or a forwarding rule to a queue we manage. You keep control and can revoke any time.
Can you help us formalize the program later? +
Yes, including scope definition, policy language and platform migration when you're ready. Read our program readiness checklist on the blog for a preview.
Full pricing and process details are on the home page, or read how we triage.
Try us on your real queue.
Book a 30-minute call and we'll scope a trial on your Self-hosted programs intake. You judge the verdicts, then decide.