BugCrowd Integration with DefectDojo

Bugcrowd Integration with DefectDojo

Bugcrowd is a crowdsourced security platform that connects organizations with independent security researchers. Companies use it to run bug bounty programs, vulnerability disclosure programs (VDPs), and penetration tests against web applications, APIs, mobile apps, and other targets. Researchers submit findings through the Bugcrowd platform, where Bugcrowd's team triages them and rates each one with a priority based on its Vulnerability Rating Taxonomy (VRT). Submissions can be exported as CSV or read through the Bugcrowd REST API.

Bugcrowd Integration with DefectDojo

Our Bugcrowd program finds issues that none of our scanners would, but for a long time those submissions lived in a separate portal that only the security team checked. Bringing Bugcrowd into DefectDojo puts each validated submission on the Asset it affects, next to our scanner findings, with an owner and an SLA based on its priority. Engineering works from one queue. The bounty program stops being a side channel and becomes another source of tracked findings.

Why Bugcrowd Matters

Automated testing covers known patterns. Researchers working a bounty or VDP look for what automation misses, and they are motivated to find impact.

• Submissions often cover business logic flaws, authorization issues, and chained attacks that scanners rarely detect.
• Bugcrowd's triage and VRT priority (P1 through P5) mean findings arrive with a consistent rating rather than each researcher's own opinion.
• A VDP gives outside researchers a sanctioned way to report issues, which many security policies and regulators now expect.
• Researcher findings are high signal, and they deserve the same remediation tracking as any other finding instead of a status column in a separate tool.

Advantages of This Integration

What we gained by routing Bugcrowd submissions through DefectDojo:

• One queue for every source. Bugcrowd findings sit on the same Asset as SAST, DAST, and SCA results, so engineering doesn't have to check another platform.
• Priority mapped to severity. P1 through P4 map to Critical, High, Medium, and Low, so DefectDojo's SLA rules apply to bounty findings automatically.
• Structured findings. The parser splits the researcher's write-up into description, impact, steps to reproduce, and mitigation, which makes the Finding usable without opening Bugcrowd.
• Remediation that outlives the submission. Each finding gets an owner, notes, a status history, and can be pushed to Jira with reproduction steps attached.
• Scheduled sync with DefectDojo Pro. The Bugcrowd connector pulls submissions per program through the Bugcrowd API, preserves Bugcrowd severity, and excludes duplicate submissions.

How This Integration Works

There are two supported ways to bring Bugcrowd data into DefectDojo.

Option 1: CSV file import (Community Edition and DefectDojo Pro). Export submissions from Bugcrowd as CSV, then import the file with the BugCrowd Scan scan type. The parser expects Bugcrowd's export columns, such as title, priority, description, bug_url, vrt_lineage, remediation_advice, and submitted_at.

In the UI, open the Engagement for the program, choose Import Scan Results, select BugCrowd Scan, and upload the CSV. To automate it:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=BugCrowd Scan" \
  -F "file=@bugcrowd-submissions.csv" \
  -F "product_name=mobile-app" \
  -F "engagement_name=Bug Bounty" \
  -F "auto_create_context=true"

DefectDojo Pro users can do the same with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "BugCrowd Scan" \
  --report-path "./bugcrowd-submissions.csv" \
  --product-name "mobile-app" \
  --engagement-name "Bug Bounty" \
  --auto-create-context

Option 2: Bugcrowd connector (DefectDojo Pro). The connector uses the Bugcrowd REST API to import submissions from bug bounty and vulnerability disclosure programs. Configure it in the DefectDojo Pro UI:

1. Enter https://api.bugcrowd.com in the Location field.
2. Enter a Bugcrowd API token in the Secret field. Create it under Organization settings, API credentials; read access to submissions, programs, and targets is enough. A dedicated service account keeps automated activity separate.
3. Optionally, set a Minimum Severity.

DefectDojo discovers the programs the token can access and creates a Record for each program, which you map to an Asset. Submissions import with their Bugcrowd severity, and duplicate submissions are excluded.

A note on the older API pull: the Bugcrowd API Import scan type configured through Tool Configuration is deprecated as of 3.2.0 and will be removed in 3.5.0 (November 2026). New setups should use the connector or CSV import.

Data Granularity: What Gets Imported

The table describes the CSV import.

The parser recognizes write-up sections separated by --- with headings such as Impact, Steps to reproduce, How to fix or Fix, and PoC code. Within one CSV, rows with the same title and description are imported once.

Use Cases

Running a public bug bounty: The security team exports validated submissions weekly and imports them into an Engagement per program. Each P1 or P2 finding is assigned to the owning team and pushed to Jira the same day, and SLA reports show whether fixes land in time.

Operating a VDP: An organization with a disclosure program but no bounty uses DefectDojo to prove each report was handled. Discovery date, owner, and closure date are kept on every finding.

Continuous sync with DefectDojo Pro: Teams with several Bugcrowd programs use the connector, map each program's Record to its Asset, and let scheduled syncs keep findings current as researchers submit.

Measuring coverage gaps: With bounty findings next to DAST and SAST results on the same Asset, AppSec leads can see which vulnerability classes only researchers are finding and adjust scanner coverage or testing scope.

Operational Tips

• Filter your CSV export before importing. The parser does not read the state, substate, or duplicate columns, so rejected or duplicate submissions in the file are imported like any other row.
• Review severities for P5 submissions. They arrive as Info, which is usually right, but confirm your SLA configuration treats Info the way your program expects.
• Use one Engagement per program and reimport into the same Test so updated exports keep a single history.
• Payout and researcher username land in the description. If findings are shared widely or pushed to Jira, decide whether that information should travel with them.
• On DefectDojo Pro, prefer the connector over CSV for ongoing programs. It removes manual exports and excludes duplicates for you.
• Migrate any Bugcrowd API Import configurations before the 3.5.0 release removes them.