# How I Manipulated My Rank on the Bugcrowd Platform

Bugcrowd API let a demo program's claimable submissions award demo points that fed the real ranking algorithm, letting a researcher jump to 10th place.

- Payout: unconfirmed
- Severity: medium
- Program: Bugcrowd
- Credited: Muhammad Khizer Javed
- Disclosed: 2023-04-19
- Write-up quality: 6/10
- Original: https://blog.securitybreached.org/2023/04/19/how-i-manipulated-my-rank-on-the-bugcrowd-platform/
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-securitybreached-org-2023-04-19-how-i-manipulated-my-rank-on-the-bugcrowd-platform
- Tags: domain:api domain:web impact:integrity kind:bounty platform:blog sev:medium tech:rest technique:source-review vuln:access-control vuln:business-logic

**Target:** Bugcrowd API submissions endpoint / ranking algorithm
**Root cause:** Demo program submissions created via the API awarded demo points that were counted by the platform's ranking algorithm alongside real points, without segregating demo vs production point totals.
**Steps:**
1. Create a researcher account and a company/tracker account on Bugcrowd.
2. From the company account, create a Demo Program and obtain API credentials.
3. POST to `https://api.bugcrowd.com/bounties/<BOUNTY-UUID>/submissions` with headers `authorization: Token <API-TOKEN>`, `content-type: application/json` and body `{"submission":{"source":"platform","title":"Security Breached","submitted_at":"2022-06-07T00:00:00.181Z","substate":"resolved","vrt_id":"server_side_injection.remote_code_execution_rce","priority":"1","researcher_email":"<researcher>@bugcrowdninja.com"}}`.
4. Receive the claimable submission email, claim it, and collect demo points.
5. Repeat to accumulate enough demo points to exceed the target rank's point total.
**How found:** Researcher was testing the Bugcrowd platform and noticed demo points from imported/claimed submissions appeared in the submissions sidebar total and affected rank, then tested whether API-created demo submissions could be claimed and counted.
**Exploitation:** Attacker with a company account creates a demo program, uses its API token to file resolved high-priority submissions against their own researcher email, claims them, and accumulates demo points that the ranking algorithm counts, pushing their rank above legitimate researchers (e.g., 3205 points ranked 10th over 13789 points).
**Insight:** On crowdsourcing/ranking platforms, check whether sandbox/demo/test program artifacts (points, submissions, reputation) are excluded from the production scoring pipeline; API-created objects in a demo tenant may still feed global aggregates.