Skip to main content
ArcBlock Community

BugBounty - What’s the criteria for bugs reported to Qualify

Brain Titan
Support
qa

I was wondering what is the criteria to qualify for BugBounty? Some of the bugs I report are marked as Qualified but sometimes other bugs are not marked😁

7 replies

wangshijun2 years ago

Thank you for participating in our Bug Bounty Program and raising this question. We truly appreciate your efforts and contributions to improving our community and products. I understand that you have questions regarding the criteria for qualifying a reported bug for the Bug Bounty, and I'm here to provide some clarity.

Qualification Criteria for Bug Bounty:

  1. Validity: The reported issue must be valid; that means it should not be based on hypothetical or non-reproducible scenarios. It should be a genuine bug that affects the functionality, security, or usability of our products/services.
  2. Uniqueness: The bug must not be a duplicate. If the issue has already been reported by another user, or if it is already known to us and under review, it will not qualify as a unique submission.
  3. Reproducibility: The issue should have enough context and clear steps for reproduction. A bug that cannot be consistently reproduced by our team may require further information and might take longer to qualify.
  4. Impact: The severity and impact of the bug also play a critical role. Issues that pose significant risks to the functionality or security of our products or that could lead to a better user experience are given priority.

Review Process:

  • Every bug report is manually reviewed by our team to ensure it meets these criteria.
  • We aim to review all reports thoroughly, which sometimes means we need additional time to explore the nuances of a reported issue, especially when the bug is not immediately obvious or lacks sufficient context.
  • Each valid, unique, reproducible, and impactful report is marked as "qualified" once it passes our review process.

Monthly Review and Rewards:

  • We strive to review all bug reports before the end of each month. This timeline ensures that any qualifying reports are recognized and rewarded in that month's Bug Bounty distribution.

We understand that not every report will be marked as qualified, and this can sometimes be disappointing. However, please know that every report is valuable and helps us to improve. Even if a report does not meet all the criteria at the time of submission, we often need to gather more information, and we may reach out to you to help us better understand the issue.

Thank you again for your engagement and dedication to making our community and products better. We look forward to your continued participation and more of your insightful contributions.

❤️1👍1
Brain Titan2 years ago

very insightful, thanks!🙌

This also explains another question why sometimes when reporting a bug you have ArcBlock team assigned to it for fixing but post is not Qualified for BugBounty yet, it‘s because it might take more time to inspect/replicate/fix the bug, then the post Qualifies later on💪

wangshijun2 years ago

Yes, some issues may seem obvious from the surface, but it requires cross-team work to fix it.

Brain Titan2 years ago

I do have another question:

What happens if you report a bug this month, the team is assigned to inspect it (but the post doesn’t yet Qualify for BugBounty, it needs more time to inspect), and then the bug only qualifies the next month for BugBounty once the team investigates and fixes the issue.

So if the team is unable to verify the bug in the month it was posted, would the qualified post carry over to the next month for BugBounty?

wangshijun2 years ago

If a report's submitted and qualified time spans across a month, it will get rewarded in the month it's marked as qualified, we will try our best to avoid this, 😄

Robert2 years ago

We have a review process in place, however, it is not set in stone. If you have any feedback on the results of the review (whether it be your own or others'), please feel free to pose a question and we will consider it. Also, please feel free to suggest any improvements for this process.

❤️1
Brain Titan2 years ago

Thanks Robert. It’s a good review, will let you know if I can think of improvements. I love participating in Bug Bounty, makes the users feel like they can make a difference to Arcblock🤝

❤️1
Reply