You can be restricted from submissions, meaning you won't be able to submit reports to certain programs. There are 3 reasons as to why you might be restricted from submissions:

Signal requirements allow programs to specify a minimum signal that hackers must meet to submit reports to that program. Your signal for signal requirements is based on your activity from the last 365 days.

Each program can choose to set its own requirement, anywhere from −1.0 to 7.0, and can change it at any time. A program's current requirement is shown on its program security page in the program highlights section and on the report submission form, alongside your own signal. It is worth checking before you start work on a target.

If your signal is above their requirement, then you won’t be restricted from submitting reports for that program. If you don’t meet the required signal for a program, you will be limited to 3 trial reports that you can submit so you can still participate in their program.

You have a 3 trial report limit. They're shared across every program whose signal requirement you don't meet, not 3 per program. Every submission to a program you don't currently qualify for uses one. Your trial report limit can be refilled in three ways:

Note that withdrawn trial reports, reports you close yourself, and reports closed as Informative, Not Applicable, or Spam without progressing to the Triaged stage don't return trial reports. This change should not impact researchers whose submissions land resolutions.

When you have 1 total trial report left, you'll see a yellow warning box on top of the report submission form letting you know that the number of trial reports you have left is getting lower.

Use your trial reports wisely! These limited chances are the perfect opportunity to submit the best reports you have so your signal can improve.

How many trial reports do I get?

Every Hacker gets 3 trial reports in total, shared across all programs whose signal requirements they don't meet. Not 3 per program.

How do I get them back?

Three ways. Any report of yours reaching triaged or resolved returns you to 3 immediately. Otherwise, if you use all 3 without a triaged or resolved report, on any bug bounty or VDP, you're paused from using additional trial reports for up to 90 days, and your 3 reports return when the pause ends. Or if a trial report is closed as a duplicate of a report marked as triaged” or resolved, which was not disclosed prior to your submission, your available trial reports will increase by 1 up to a total of 3 available trial reports.

Does the triaged/resolved report have to be a trial report?

No. Any report of yours that reaches triaged or resolved refills you to 3 trial reports, whether or not it was a trial report, which program it was on, or what type of program it is. A resolution on a VDP counts exactly the same as one on a program with a signal requirement, and so does a resolution on a program where your signal already clears the bar.

I submitted my third trial report, and I'm already paused. Is that a bug?

No, that's how it works. The pause starts at the moment you submit your third trial report. If one of your three is resolved, the pause ends at that point and your 3 return immediately. Otherwise, it ends after 90 days.

The old limit freed up a report every 30 days. Why is this 90?

The old 30-day timer applied to whatever your reports were, so the pace was the same for everyone, regardless of outcome. Now outcomes set the pace: a triaged or resolved report returns all 3 immediately and can do so as often as you land them, so if you're finding real issues, you never wait. The 90 days are the fallback when none of your reports are triaged or resolved, deliberately slower, because it's the path that doesn't depend on finding anything.

What about reports I close myself, withdraw, or that are closed as “Informative,” “Not Applicable,” or “Spam” without progressing to the “Triaged” state?

None of those returns a trial report.

Is the 90-day pause a ban?

No. It applies only to programs for which you don't meet the signal requirement. VDPs, programs with no signal requirement, and programs where your signal clears the bar all stay open. Comments, mediation, disclosure, and payouts on your existing reports continue as normal.

Is this related to the ID verification changes?

No, they're separate checks with separate rules, and both can apply to the same submission. Being ID verified doesn't change your trial report limit, and your trial report limit doesn't affect your ID verification status. If you're blocked from submitting, a message on screen tells you which one you've hit.

How do I stop running into this?

Focus on ensuring you submit your best work. Resolved reports raise your signal, and once your signal meets a program's requirement, trial report limits no longer apply to that program.

A program lowered its trial report limit and I have trial reports open there. What happens?

A trial report counts as open until it is triaged, resolved, or closed as a duplicate. Once enough of your open trial reports with that program are cleared, you can submit there again. Your trial reports with other programs are unaffected.