Signal requirements enable a program to set a signal threshold that hackers must reach to submit reports to the program. If a hacker falls below the threshold, they will have a restricted number of reports they can submit to your program. This will improve the quality of reports programs can expect to receive from hackers.
The signal used for signal requirements is calculated based on a rolling 365-day window. This means that a hacker’s signal is based on their activity from the last 365 days.
To enable Signal Requirements:
Go to Security page > Hacker Management > Submission.
Choose from 1 of these 4 options in the Signal Requirements section:
Option | Details |
Strict | Hackers with a proven record are unrestricted, while hackers who don't meet this requirement will have a limited number of allowed submissions to your program. A strict setting makes sense for teams that prefer fewer, higher-quality reports or that can only handle a smaller flow of reports, as it most tightly limits hacker participation based on high Signal. This is the recommended setting for new programs. |
Standard | The recommended setting for most programs. |
Lenient | Recommended for experienced programs that want to maximize the number of hackers who will help find vulnerabilities. |
Turn off Signal Requirements | Any hacker with any level of Signal will be able to submit reports to your program. Recommended for veteran programs only. |
Note: Turning Signal Requirements down or off is better for teams that value having the maximum number of hackers to help find issues.
IMPORTANT - We are making changes to this process between the 12th and 19th October. The following describes the end state for all accounts.
Every user has a 3 trial report limit. Trial reports are counted when a participant does not meet the program's signal requirements. Every submission to a program that a Hacker does not currently qualify for uses one. A Hacker’s trial report limit can be refilled in three ways:
Any report of theirs is marked as Triaged or closed with a Resolved returns their trial report limit to 3. It does not need to be a trial report and can be a VDP or BBP report; or
One of their trial reports is closed as a Duplicate of a report marked as Triaged or Resolved where the first-filed report was not disclosed prior to their submission. This returns 1 trial report, up to a total of 3; or
They use all 3 trial reports and wait out a pause of 90 days. The pause starts on the date they submit the third trial report, and ends early if any of their reports are marked Triaged or closed as Resolved.
These limits help manage report quality while still giving hackers the opportunity to participate in programs, even if they do not currently meet the program’s signal requirement.