For projects
Team and roles
Invite teammates, assign roles, and keep access tight on a platform that holds unreleased vulnerabilities.
Manage your team at Team (in the account menu).
Roles
| Role | Can |
|---|---|
| Owner | Everything, including managing owners and publishing programs |
| Admin | Publish programs and competitions; manage triagers, developers and viewers |
| Triager | Make case decisions: accept, request info, propose closure, final decisions, Won't Fix |
| Developer | Read cases, post messages and evidence, work on fixes. No decisions |
| Viewer | Read-only access to cases and analytics. Can't act or post |
Inviting
Enter a work email and a role. The invitation:
- is single-use and expires after 7 days,
- only works for the invited email address,
- is stored only as a hash, so the link is shown once. Copy it if email isn't configured,
- replaces any pending invite for the same address.
New teammates create a project account from the link and must set up two-factor authentication before they can act.
Rules that protect you
- Admins can only manage roles below their own.
- The last owner can't be removed or demoted. Promote another owner first.
- Researcher and mediator accounts can't join an organization. Team members use separate project accounts, which keeps conflicts of interest out.
- Every invite, role change and removal is recorded in the audit log.
- Members without MFA are flagged on the team page and can't act on cases until they enable it.