Identity and access

The platform holds unreleased vulnerability data and the access credentials used to find it. Its access model is therefore built around least privilege and attributable actions.

Authentication

Mechanism	Detail
Token authentication	Standards-based tokens with asymmetric signing and public key discovery, so verification does not depend on a shared secret
OAuth 2.0 social sign-in	Google and GitHub
Multi-factor authentication	TOTP-based MFA supported for all account types
Session management	Sessions can be listed and revoked; revocation takes effect on the next request
Rate limiting	Applied to authentication and other high-risk operations

Expert access: three gates

Expert access to customer engagements is deliberately harder to obtain than researcher access, because experts are given credentials and internal network reach. An expert must satisfy all three of:

Role — the account is an expert account, not a general one.
Entitlement — the organisation's plan includes expert engagements, and the engagement is licensed.
Invitation — a valid, unexpired invitation to that specific engagement has been accepted.

Missing any one of these means no access to the engagement's assets. The gates are enforced at access-decision time rather than in the UI, so an API call cannot bypass them.

Authorisation model

Permissions are role-based and fine-grained:

Participant type	Typical scope
Company owner	Organisation-level control, billing, and all programs
Administrator	Program configuration, participants, and policy
Program manager	One or more programs: scope, triage, rewards, disclosure
Researcher	Own submissions, own rewards, program policies they participate in
Expert	Invited engagements only, under the engagement's rules of engagement
Platform administrator	Platform operations, with audited and restricted actions

Roles are composable, so a person who is both a program manager and a reviewer does not need a second account. Administrative operations default to least privilege: an action that is not explicitly granted is not available.

Entitlement-aware feature gating

Capabilities that are plan-dependent are enforced by the same access layer that enforces roles. An unlicensed capability is not reachable, which keeps the commercial model and the technical model consistent.

Governance and assurance

Audit trail across administrative actions: who did what, to which record, and when.
Step-up verification for sensitive financial operations such as large payouts or payout-method changes.
Approval queues for program and participant onboarding, so joining is a decision rather than a default.
IP allowlisting for administrative surfaces, so administration can be restricted to known networks.
Data minimisation — sensitive fields are filtered from API responses rather than being returned and then hidden in the interface.
Rate limiting on authentication, sensitive and high-risk operations.

What this means in practice

Administrative access should be allowlisted. If nobody administers the platform from an open network, there is no reason to permit it.
MFA is not optional for administrators. The accounts that can change scope and approve payouts are the ones worth protecting most.
Review roles on a schedule. Access that is granted for one project tends to stay granted; a periodic review catches it.
Treat expert invitations as credentials. They are time-bounded and should be issued per engagement, not reused.

Availability and limits

Role-based access control, MFA, session revocation, audit trails, rate limiting and approval queues are part of the platform's baseline security model.
Administrative IP allowlisting is available on Enterprise-tier plans and above where configured.
Platform assurance claims (MFA, encryption, audit trails) describe the platform's own controls. They do not by themselves determine the security outcome of your program.

Evidence and file security — how access control applies to stored evidence
Tax and reporting — protection of identity and tax data
PTaaS engagement lifecycle — where expert access fits in an engagement
Platform overview — how these services fit together