Automated Bugcrowd Submission Handoff
Every morning, WebRun opens Bugcrowd, checks for new vulnerability submissions awaiting triage, archives a copy of each report to Google Drive, and texts your triage lead a summary of the day's queue so nothing sits unassigned.
How do I hand off new Bugcrowd submissions to my triage lead each day?
WebRun checks Bugcrowd every morning for new vulnerability submissions, archives a copy of each report to Google Drive, and texts your triage lead a summary of the day's queue, flagging anything marked critical. It never validates a finding or replies to the researcher itself, so your team still makes every triage call.
- New submissions get archived and handed off the same morning they arrive
- Critical reports are flagged for immediate attention
- Every report has a permanent, dated archive in Google Drive
Built for security teams · AppSec engineers · bug bounty program managers · IT admins
What does WebRun do on every run?
The exact actions WebRun takes, in order - in plain language, so you can adjust anything.
-
WebRun signs in and gets to work
Opens
www.bugcrowd.comin a real browser with your saved login - no setup, no API keys. -
1
Bugcrowd - check new submissions
bugcrowd.com
WebRun opens Bugcrowd to check new submissions. - Open Bugcrowd and list submissions received since yesterday
- Note the researcher, target, and reported severity for each
- Flag any submission marked critical by the researcher
Done when Every new submission has been reviewed and logged.
-
2
Google Drive - archive each report
drive.google.com
WebRun opens Google Drive to archive each report. - Open the submissions archive folder in Google Drive
- Save a copy of each new report with target and date
- Keep prior submissions alongside for reference
Done when Today's new submissions are archived in Google Drive.
-
3
Twilio - text your triage lead
twilio.com
WebRun opens Twilio to text your triage lead. - Text your triage lead a summary of today's submission queue
- Name the count and flag any marked critical
- Send only to the triage lead's saved number
Done when Your triage lead has been texted today's queue summary.
How is each run configured?
Secure by default
Connect once, stays signed in
WebRun signs in once and keeps each session in a persistent environment, so every run picks up right where it left off.
Every action is checked against this policy before it runs.
Questions, answered
Does WebRun validate or pay out a submission itself?
No. WebRun only reports what came in overnight. Validating a finding, deciding severity, or approving a payout is left for your triage lead.
Does it respond to the researcher?
No. WebRun never messages a researcher on Bugcrowd. It only archives the report and hands the queue to your team internally.
What if no new submissions came in?
It still checks each morning, but only texts your triage lead when there is at least one new submission to hand off.
Related templates
Put this on autopilot.
Turn it on in minutes - or have our team set it up for you.