Our commitments

What we will and won't do.

A ratings platform accumulates two things worth being careful with: a record of people's reputations, and influence over where they spend their time. If we're vague about how we handle either, you have no reason to trust the grades or the credentials attached to them. So we've written the rules down. These are founding commitments, not marketing — the boundaries we'll be held to as BugRater grows, and as we roll out BugBadge, a portable researcher credential that attests a track record rather than a legal identity.

Reputation, never identity

BugRater does not collect, require, or store government-issued identification. No passport, no driver's licence, no national ID — and we will not introduce it later. Standing on this platform is earned through verified platform accounts and a public track record, not through proof of who you are offline.

This is deliberate. Identity-verification requirements lock out the people who often have the most to offer: researchers who work under a handle, people in countries where the "acceptable" documents are hard to obtain, and anyone who simply won't hand a private company their ID for operational-security reasons. A BugBadge is designed so that a pseudonymous researcher with a real record can carry that record anywhere, without ever unmasking themselves to do it.

We never touch money

Bounties are paid directly between the researcher and the program. BugRater is not an escrow, a payment processor, a broker, or a party to any disclosure or settlement. We take no cut of a bounty and we hold no funds at any point.

This is a deliberate design choice, not an accident. Platforms that move money end up needing banking details and identity documents to do it — and once that plumbing exists, the pressure to verify who you are never goes away. By never intermediating a payment, we keep the commitment above structurally easy to honour instead of fighting our own architecture to preserve it.

Signal, not warranty

A BugBadge, a letter grade, and a review are all evidence to weigh — never a guarantee about a person or a program. A badge says a researcher had a verifiable track record at a point in time; it does not promise how they'll behave on your program. A grade summarises reported experiences; it does not certify a program's future conduct.

Responsibility stays where it belongs. Programs remain fully responsible for their own triage decisions — a badge is context, not a hiring guarantee or a reason to skip your own process. Researchers remain responsible for their own conduct and for honouring the disclosure rules of the programs they work with. We provide the signal; we don't stand behind the outcome.

Balanced by design

Complaint walls only tell you where not to go. We publish good experiences as loudly as bad ones, through one standardized form, so a grade means the same thing across every program — and so a fast, fair program gets the credit it earns instead of only the silence of no complaints.

The researcher owns their reputation

The record you build here is yours. It's portable — a BugBadge is meant to travel with you rather than lock you in — exportable, and deletable. If you delete your account, your reputation on BugRater goes with it. We don't hold your standing hostage to keep you on the platform.

Hold us to it

These commitments only mean something if you can check that we kept them. Changes to how the platform works are recorded in our change notes, so any shift in these principles is auditable rather than quietly slipped in. If you think we've crossed one of these lines, tell us at hello@bugrater.com — and hold us to what's written here.