Bug Bounty Intake
Research
Intake a bounty report with asset, impact, and a defender-facing confirmation note — a mailbox, not a payout engine.
A bounty program that only publishes an email address gets reports in the same pile as password resets. This GRTforms template is intake: asset, impact, and how a defender can confirm it. It is not a payout engine and it does not decide an award.
Who it is for
Product security teams who pay for in-scope findings and still triage in a human inbox.
When to use it
Link it from the bounty brief. Security Disclosure is the no-payment mailbox. Support Request is a customer defect. Do not put working exploits in a public success message.
What this form collects
Handle, contact email, severity guess, asset, impact, a defender confirmation note, payout expectation, and optional evidence.
- Public bounty program contact form
- Private program for invited researchers
- Partner-reported issues that might be paid
Preview mode: This is a live read-only render of the template. Sign up to clone it into your account, or customize it with the guest AI builder first.
Bug Bounty Intake
Frequently asked questions
Does submitting this pay me?
No. GRTforms stores the report. Your team still scopes it and pays through the process you already publish. The form is the mailbox.
How is this different from Security Disclosure?
Security Disclosure assumes you may not pay. Bug Bounty Intake assumes a program exists and asks whether they want to be considered. Keep both if you run both paths.
Why not a single “how to reproduce” box?
Impact and confirmation are different jobs. Splitting them keeps a researcher from pasting a payload and calling it a report.
Related templates
Nearby GRTforms templates for the same job or the next step after this one.
Security Disclosure
Give researchers a place to report a vulnerability with severity, product area, and a non-public write-up.
Feature Request
Collect product ideas with the job to be done, urgency, and who would use the feature.
API Access Request
Let developers request sandbox or production API access with intended use, volume, and who should own the keys.
Support Request / Bug Report
Collect reproducible bug reports with severity, steps, and optional screenshots.
Beta Access Request
Qualify a beta seat with product area, current tool, and the job they would run so you invite people who will actually try it.