One Submission at a Time, Blocking Reporters, and Bans for Repeat Abuse

Program owners have been getting the same bug several times over, and reports that skipped the AI scope check warning. Part of that is on us. The AI checks were slow, and when a page sits there for a while it's fair to wonder if your report got lost. So people hit submit again.

A check that hangs now fails with a clear message instead of leaving you guessing, and we've tightened the rest.

The scope check

If a report looks out of scope, the AI scope check stops it and shows this:

Some hunters hit Submit Anyway on every report. Each of those still lands on a real person who has to read it and close it.

One submission at a time

If a check hangs now, it times out and tells you the report wasn't submitted, with your text filled back in so you can send it again. You can also only have one report going through AI triage at once. Start a second while the first is still being checked and you're sent back to the first one. The new text isn't submitted. The API returns a 429 with a Retry-After header.

Submit Anyway gets flagged

When a hunter submits anyway, the report's AI Triage section now says so. Owners, admins and triagers get a button to block that hunter from submitting to the program again.

Blocks show up in a Blocked Reporters list on the Hunters tab, where you can undo them, and they're in the REST API too. Staff can't be blocked.

Submit Anyway is staying. The AI gets things wrong, and we don't want a real bug blocked. If you think it's wrong, use it. If you already know the bug is out of scope, don't.

Strikes

Multiple strikes will get you banned from Bugbop permanently, not just from one program.

Don't make a second account to get around a ban. If you do, we can withhold your payouts, including bounties we've already awarded. It's in the Terms now (6.6 and 8.1).