How to Hunt on BugChase: A Researcher's Onboarding Guide

Researcher onboarding for BugChase — create an account, complete profile and KYC gates, choose programs, write VRT-structured reports, and get paid in PKR.

BugChase exists to give Pakistani security researchers a first-class place to do their work: real programs, clear scope, fair triage, and rewards paid in PKR. This guide walks a new researcher through the full journey, from creating an account to landing your first validated payout, so you can spend your energy hunting instead of navigating logistics.

Start by signing up as a researcher and verifying your email. Then complete your profile thoroughly. Your profile is your reputation on the platform — a complete profile with relevant skills and history builds trust with program owners and can unlock private invitations. Some capabilities are gated behind eligibility checks, including profile completeness and, where required, identity verification (KYC), so finishing onboarding early removes friction later when you want to submit or get paid.

Understand the eligibility gates before you start testing. BugChase applies reputation and profile requirements to keep programs high-signal and to satisfy the compliance needs of organizations paying real money. Completing KYC where required ensures your rewards can be paid out without delay. Think of these gates not as obstacles but as the mechanism that makes serious, well-funded programs willing to open their assets to the crowd.

Next, choose your programs deliberately. Browse public programs or accept private invites, and read each program's scope and Rules of Engagement carefully before you touch anything. The scope tells you exactly which assets are authorized for testing and which are off-limits. Testing outside scope is not protected by safe harbor and can jeopardize your standing, so treat the scope as a hard boundary, not a suggestion.

When you find something, the quality of your report determines the quality of your outcome. Strong reports share a structure: a clear title, the affected asset, a concise description of the vulnerability, precise step-by-step reproduction instructions, and a realistic assessment of impact. Where the program uses a Vulnerability Rating Taxonomy (VRT), map your finding to the appropriate category so triagers can assess severity consistently. A report a triager can reproduce in two minutes gets validated far faster than a vague one.

Impact is what separates a good report from a great one. Do not just prove that a bug exists — explain what an attacker could actually do with it. Access another user's data? Take over an account? Move funds? Concrete, demonstrated impact drives severity, and severity drives your reward. At the same time, respect the boundaries: demonstrate impact with the minimum access necessary, and never exfiltrate, alter, or destroy data to make your point.

During triage, use in-platform chat to answer questions and provide clarification. Triage is a collaboration, not a confrontation. Responsive, professional communication builds a reputation that leads to more private invites and smoother future engagements. If you disagree with a severity decision, make your case with evidence and let the documented process work — a reputation for being both skilled and reasonable is worth more than winning any single dispute.

When a finding is validated, your award lands in your BugChase wallet for PKR payout. Over time, consistent quality builds your reputation score, unlocks higher-value private programs, and — with your consent — can earn you a place on the public Hall of Fame, where top researchers are recognized for their contributions. That public track record compounds: it attracts invites, builds your professional profile, and establishes you within Pakistan's growing security community.

The researchers who thrive on BugChase are not always the ones who find the most bugs — they are the ones who report clearly, communicate well, and operate within scope consistently. Master those habits and the platform will reward you with better programs, faster triage, and a reputation that opens doors.

Create researcher account