figma guide
Designing bug bounty and vulnerability disclosure program UI in Figma: scope, submissions, and researcher workflows
Design bug bounty and vulnerability disclosure program UI in Figma with scope rules, safe harbor, submission forms, triage queues, reward tiers, and researcher dashboards.
- Published
- Updated
- Jul 30, 2026
- Read time
- 10 min
- Level
- Intermediate
Quick answer
Bug bounty and vulnerability disclosure program (VDP) UI is how security teams invite external researchers to report flaws safely—clear scope, safe harbor language, structured submissions, and transparent triage without leaking exploit details. Design a public program hub with scope, out-of-scope rules, and reward tiers; a researcher submission portal with severity self-assessment and encrypted attachments; an internal triage queue linked to vulnerability management; and a researcher dashboard for status, duplicates, and payout tracking. Start from the Figma guides hub and pair with trust center, security posture dashboard, audit log, incident runbooks, and Dev Mode handoff.
Who this is for
- Product designers building public VDP pages, HackerOne/Bugcrowd-style portals, or in-house researcher platforms for B2B SaaS.
- Design system teams aligning severity badges, scope tables, and submission wizards with forms, badges, and modals.
- Security and legal teams implementing safe harbor, scope enforcement, duplicate handling, and payout workflows.
Public program hub
BugBountyHub — security.acme.com/bug-bounty · Program v3.2 · Updated 2026-07-01
├── Hero: Responsible disclosure · Safe harbor · Average first response 2.4 days
├── Quick stats: 847 reports · 312 valid · $1.2M paid · Hall of fame 89 researchers
├── CTAs: [ Submit a report ] [ View scope ] [ Program rules ] [ Hall of fame ]
├── Tabs: Scope · Rewards · Rules · Safe harbor · FAQ · Contact
├── Scope summary: *.acme.com · api.acme.com · mobile apps · Excludes: third-party SaaS
├── Reward range: Critical $5k–$25k · High $1k–$5k · Medium $250–$1k · Low $50–$250
└── Footer: security@acme.com · PGP key · Link to [trust center](/designing-trust-center-and-security-documentation-ui-in-figma/)| Section | Purpose |
|---|---|
| Scope | In-scope assets with environment labels (prod, staging) |
| Out of scope | Social engineering, DoS, third-party dependencies without PoC |
| Rewards | Tier table with examples; note discretionary bonuses |
| Safe harbor | Legal language researchers need before testing |
| Rules | One report per issue; no public disclosure before fix |
| Hall of fame | Opt-in researcher recognition |
Verdict: Public hub is legal + security marketing—Legal must approve safe harbor text before publish; scope must match actual DNS and app inventory.
Scope and asset registry
ScopeRegistry — In scope · Last reviewed 2026-06-15
├── Production:
│ ├── *.acme.com (web app, marketing) · Max severity: Critical
│ ├── api.acme.com · Rate limit: 10 req/s for automated testing
│ ├── admin.acme.com · Requires researcher account provisioning
│ └── iOS/Android apps · Latest store builds only
├── Staging (limited):
│ ├── staging.acme.com · No real customer data · Medium max payout
│ └── sandbox-api.acme.com · API keys via researcher portal
├── Out of scope:
│ ├── *.acme-cdn.net (CDN only — report to provider)
│ ├── Third-party chat widget · Redirect to vendor program
│ ├── Physical security · Out of program
│ └── DoS / load testing without written approval
└── [ Download scope.json ] [ Subscribe to scope changes ] [ Request test account ]| Asset field | UI detail |
|---|---|
| Domain / app | Clickable; environment badge (prod, staging) |
| Max severity | Caps payout for staging or legacy apps |
| Rate limits | Prevents accidental DoS during scanning |
| Test account | Request flow for admin-only surfaces |
| Out of scope reason | Short explanation + redirect link |
| Last reviewed | Freshness signal for researchers |
Link scope changes to audit log—researchers screenshot outdated scope during disputes.
Use tables for asset lists; badges for environment and severity caps.
Researcher submission form
SubmitReport — Step 2 of 4: Vulnerability details
├── Asset: api.acme.com/v2/payments · Auto-suggest from scope registry
├── Vulnerability type: [ ] XSS [ ] IDOR [x] Auth bypass [ ] SSRF [ ] Other
├── Severity (self-assessed): High · CVSS calculator link
├── Title: Payment API allows cross-tenant refund without auth
├── Description: Markdown · Min 100 chars · Template hints
├── Steps to reproduce: Numbered list · Required
├── Impact: What attacker can do · Required
├── Proof of concept: [ Upload encrypted zip ] Max 25MB · PGP optional
├── Affected versions: Web · API v2.3 · Mobile 4.1.0
├── Researcher: handle@hackerone.com · PGP key on file ✓
├── Safe harbor ack: [x] I agree to program rules · Required
└── [ Save draft ] [ Submit report ] · Duplicate check runs on submit| Field | Handoff detail |
|---|---|
| Asset picker | Autocomplete from scope; warn if out of scope |
| Vulnerability type | Enum; maps to internal taxonomy |
| Self-assessed severity | Informational only; triage may override |
| Repro steps | Rich text; min length validation |
| PoC attachment | Virus scan; encrypt at rest; access audit |
| Safe harbor checkbox | Timestamp + IP logged |
| Duplicate check | Hash title + asset; suggest existing report |
Multi-step wizard uses progress stepper—researchers abandon long single-page forms.
Never show other researchers’ PoC in duplicate suggestions—title and status only.
Internal triage queue
TriageQueue — 23 open · SLA: Critical 24h · High 72h · Medium 7d
├── Filters: Severity · Status · Asset · Assignee · Source (VDP / pentest / internal)
├── Row: VDP-2026-1847 · High · api.acme.com · Auth bypass · 6h ago · Unassigned
├── Bulk: [ Assign ] [ Mark duplicate ] [ Request more info ] [ Escalate to incident ]
├── Detail drawer:
│ ├── Report VDP-2026-1847 · Researcher: crypt0naut · Safe harbor ✓
│ ├── Triage severity: [ Critical ] [ High ✓ ] [ Medium ] [ Low ] [ N/A ]
│ ├── Status: New → Triaged → Needs fix → Fixed → Rewarded → Closed
│ ├── Link to VM finding: VM-8842 · Same repro attached
│ ├── Internal notes (hidden from researcher)
│ ├── Researcher comms: Thread · Last reply 2h ago
│ └── Reward: $3,500 proposed · Pending security lead approval
└── Metrics: Mean time to triage 1.8d · Valid rate 38% · Duplicate rate 22%| Status | Researcher-visible label |
|---|---|
| New | Received |
| Triaged | Under review |
| Needs more info | More information needed |
| Needs fix | Valid — fix in progress |
| Fixed | Resolved — pending reward |
| Rewarded | Reward issued |
| Duplicate | Duplicate of VDP-XXXX |
| N/A | Out of scope / not applicable |
Triage queue should sync or link to vulnerability management—one finding object, two views (researcher + internal).
Critical valid reports may trigger incident runbook—design one-click escalate with pre-filled summary.
Reward tiers and payout workflow
RewardTiers — Program v3.2 · Effective 2026-01-01
├── Critical: $5,000 – $25,000 · RCE, auth bypass affecting all tenants
├── High: $1,000 – $5,000 · IDOR on sensitive data, stored XSS in admin
├── Medium: $250 – $1,000 · CSRF on state change, info disclosure
├── Low: $50 – $250 · Missing headers, low-impact issues
├── Bonus: +25% first valid report on new asset · Discretionary excellence bonus
└── Out of scope: $0 · May still send thank-you + hall of fame creditPayoutApproval — VDP-2026-1847 · Proposed $3,500 · Status: Pending finance
├── Severity: High (confirmed) · Asset: api.acme.com · Fix deployed 2026-07-28
├── Researcher: crypt0naut · Tax form W-9 on file ✓ · Payment: PayPal / wire
├── Approval chain: Security lead ✓ → Finance ⏳ → Auto-notify researcher
├── Duplicate check: None · CVE assignment: Pending
└── [ Approve ] [ Adjust amount ] [ Deny with reason ] · Reason visible to researcher| Payout state | UI treatment |
|---|---|
| Proposed | Internal only; amount + rationale |
| Pending approval | Finance queue badge |
| Approved | Researcher notified; ETA shown |
| Paid | Transaction ID; receipt download |
| Adjusted | Show original vs final with comment |
| Denied | Required reason; appeal link optional |
Finance integration needs PII separation—researcher payment details in restricted admin view, not in general triage drawer.
Researcher dashboard
ResearcherDashboard — crypt0naut · 12 reports · 7 valid · $18,750 earned
├── My reports:
│ VDP-2026-1847 · High · Under review · Last update 2h ago
│ VDP-2026-1802 · Medium · Rewarded $750 · Paid 2026-07-10
│ VDP-2026-1755 · Duplicate of VDP-1740 · Closed
├── Notifications: [ ] Email [x] Platform · Scope change alerts ✓
├── Profile: PGP key · Payment method · Tax form · Hall of fame opt-in ✓
├── Resources: Scope JSON · Test account status: Approved · API docs link
└── [ Submit new report ] [ Download tax summary 2026 ]| Feature | Why it matters |
|---|---|
| Status timeline | Reduces “any update?” emails to security@ |
| Scope change alerts | Researchers retest after new assets added |
| Duplicate reference | Link to original report ID only—no PoC leak |
| Tax summary | Year-end export for US/international researchers |
| Test account status | Pending / approved / revoked with reason |
Use empty states for first-time researchers with guided submit CTA.
Comparison: VDP vs managed bug bounty platform
| Dimension | Self-hosted VDP portal | HackerOne / Bugcrowd |
|---|---|---|
| Branding | Full control on trust site | Platform chrome + your program page |
| Researcher pool | Smaller; you drive traffic | Large existing community |
| Payout | Your finance workflow | Platform handles many payment methods |
| Triage UI | Custom queue + VM integration | Platform triage + API sync |
| Safe harbor | Your Legal wording | Platform + your policy |
| Cost | Engineering + security time | Platform fees + bounties |
Many teams start with VDP only (no monetary rewards), then add bounties—design reward tier section as optional/collapsible for VDP-only mode.
Handoff checklist (Dev Mode)
- Program object — version, safe harbor text hash, effective date.
- Scope asset — domain, environment, max severity, rate limit, test account required.
- Report object — status enum, severity (self + triaged), duplicate_of_id, safe_harbor_ack_at.
- Attachment — encrypted storage, scan status, download audit per viewer.
- Reward — tier, proposed amount, approval chain, payout transaction ID.
- Researcher profile — handle, PGP, payment method token, tax form status.
- Notification — scope change, status update, payout issued templates.
- VM sync — webhook or shared finding ID to vulnerability management.
- Accessibility — submission form keyboard navigable; severity not color-only.
Common mistakes
| Mistake | Why it hurts | Fix |
|---|---|---|
| Scope list stale vs production | Invalid reports + researcher frustration | Sync from asset inventory; monthly review task |
| Safe harbor buried in PDF | Legal exposure if researcher didn’t see it | Checkbox on submit + link in hero |
| PoC visible to all triage users | Insider threat; leak | Role-based attachment access |
| Duplicate shows other PoC | Second researcher weaponized | Show ID and status only |
| No researcher status updates | Email flood to security@ | Dashboard timeline + email prefs |
| Reward table without examples | Disputes on every High report | Add 2–3 concrete examples per tier |
| Staging same payout as prod | Budget blowout from scanners | Cap severity/payout on non-prod |
| No link from trust center | Researchers can’t find program | Prominent footer link on trust hub |
| Critical report stuck in queue | Active exploitation window | SLA badges + escalate to incident |
| Public hall of fame without opt-in | Privacy violation | Default off; explicit opt-in |
Recommended workflow
- Design public hub with scope table, reward tiers, safe harbor, and rules.
- Build multi-step submission form with asset validation and encrypted uploads.
- Create internal triage queue linked to vulnerability management.
- Spec payout approval flow with finance handoff and researcher notifications.
- Add researcher dashboard with status timeline and scope change alerts.
- Link from trust center and security posture dashboard for program health metrics.
FAQ
VDP without monetary rewards?
Yes—design VDP mode with “Recognition / hall of fame” instead of dollar tiers. Submission and triage UI stays the same; payout steps hidden.
Same queue as pentest findings?
Unified finding object is ideal—source field distinguishes VDP, pentest, SAST. Researcher-facing status is a filtered view; internal notes never sync outward.
Link to trust center?
Bug bounty link belongs in trust center footer and security docs. Program rules PDF can live in document library (public tier).
During active incident?
Show banner: “We are responding to an active incident—triage may be delayed.” Do not pause submissions; duplicates may reveal related flaws.
CVE assignment UI?
Optional CVE request step after fix deployed—internal admin only; researcher notified when published.
Next steps
- Design trust center and security documentation UI in Figma — public link to bug bounty program
- Design vulnerability management and penetration test findings UI in Figma — internal triage and remediation
- Design security posture dashboard and compliance checklist UI in Figma — program metrics for leadership
- Design incident response runbooks and security playbooks UI in Figma — escalate critical valid reports
- Design audit log and security activity UI in Figma — PoC access and scope change audit
§ Keep reading
Related guides.
figma guide 9m
Designing SLA dashboard and uptime reporting UI in Figma: targets, credits, and customer-facing reports
figma guide 9m
Designing customer incident status page and communication UI in Figma: components, subscriptions, and updates
figma guide 11m