CASE STUDY · Security Marketplace SaaS

BugChase

Founder-built, multi-role SaaS marketplace connecting companies with security researchers for bug bounty and vulnerability-disclosure programs.

The problem

Companies running vulnerability-disclosure programs juggle email threads, spreadsheets, and untrusted channels. Researchers waste time on targets that don't pay, and neither side has a structured way to triage, score, or resolve reports.

The platform also had to hold sensitive vulnerability data and survive attention from the most adversarial user population on the internet — security researchers who probe everything.

The solution

I designed and built BugChase as a five-service architecture: separate concerns for the public site, core API, triage workflow, payments and ledger, and notifications — each independently deployable and failure-isolated.

Multi-role access for companies, triagers, researchers, and admins sits on a shared permission layer. Every report moves through a state machine with audit logging; sensitive fields are encrypted at rest, and all endpoints are rate-limited and validated against an OWASP-informed checklist.

Redis handles hot paths — session state, rate counters, and leaderboards — so the MongoDB primary stays fast under burst load.

The result

Metrics marked [X] are placeholders — final numbers pending client approval.

Tech stack