New Scanners Added (CAA, CSP, DMARC, SPF)

We've added four new scanners to Bugbop: SPF, DMARC, CAA, and CSP.

These are the kinds of reports that show up in almost every program. They're low-impact, easy to find, and bug hunters love to argue about them. Often you're forced to fix them just so people stop reporting the same thing over and over.

"SPF uses ~all setting. Spoofing allowed as soft fail."

"No CAA record so any CA can issue certificates."

Then "This other program paid out $100 for this bug so you should too."

Once you've turned on Bugbot's automated scanners, it'll check for these common issues, reports them without expectation, and re-checks regularly (if you close them as 'Fixed').

When a bug hunter reports it later, it'll be automatically picked up as a "Duplicate" via Bugbot's AI triage. It's hard to argue with a duplicate report so there's no back-and-forth and no payout required. Over time, bug hunters will realise that these reports are never pay out on Bugbop and stop raising the "beg bounties".

Full technical details and setup instructions are available in our docs.

Have you ever got value from these reports? How do you handle them? Token payout? Just auto-close?