Building BugChase: a Pakistan-focused security marketplace

Context: structured security programs for Pakistan

BugChase is a Pakistan-focused crowdsourced security marketplace for vulnerability disclosure programs (VDP), bug bounty programs (BBP), and penetration testing as a service (PTaaS). In plain language, these programs give organisations a defined way to receive security findings, decide how to handle them, and work with ethical hackers through an agreed process rather than an unstructured inbox.

The product connects organisations with vetted ethical hackers through scoped programs, structured reporting, triage, and PKR payout workflows. That combination matters because a useful disclosure process needs more than a form: it needs a shared view of scope, a way to record the report, a route for review, and operational workflows for the people on both sides of the platform.

Role and product scope

Shahzaib Ahmad is the Founder and Lead Full-Stack Developer. He architected, shipped, and maintains the production platform. The work spans a multi-role SaaS product for researchers, companies, triagers, support staff, and administrators, so the product is designed around distinct responsibilities rather than a single generic account type.

The core application stack is React 18, TypeScript, Express 5, MongoDB, and Redis. This provides the web interface, application layer, persistent data, and supporting state needed for the platform’s reporting, program, and operational workflows.

Security and account controls

The platform implements JWT and refresh cookies for authentication, with a Redis token blacklist. Account controls also include OTP email verification, TOTP two-factor authentication, login audit trails, rate limiting, Helmet, CORS allowlisting, and input sanitisation. These are implementation details of the platform’s account and application controls; they are not a guarantee that any system is risk-free.

For a product that coordinates vulnerability reporting, careful handling of roles and access is part of the application design. BugChase supports separate researcher, organisation, triager, support, and administrator responsibilities, while organisation teams can use team roles and permissions within their program workflows.

Reporting, triage, and program workflows

Researchers can submit structured vulnerability reports using a VRT taxonomy, a CVSS v3.1 calculator, and a proof-of-concept editor. The researcher-facing experience also includes reputation scoring, leaderboards, and wallet withdrawals. These features give the reporting process a consistent structure while keeping the practical workflow visible to the people submitting findings.

On the organisation side, BugChase supports BBP and VDP scoping, DNS TXT and security.txt domain verification, team roles and permissions, analytics dashboards, an escrow flow, and a transaction ledger. The platform is built to support the operational work around a program as well as the initial submission of a report.

Triage includes spam filtering, duplicate-candidate retrieval, AI-assisted duplicate verdicts, programmatic CVSS scoring, Gemini-generated summaries, and routing to human triagers. The AI-assisted elements support the triage process; human-triager routing remains part of the documented workflow.

Supporting services and ongoing operations

Supporting FastAPI services cover KYC, duplicate detection, CVSS triage, and asset or subdomain discovery. BugChase also includes a separate React support portal, legal and trust pages, and SEO infrastructure alongside the primary platform.

Shahzaib deploys and maintains the applications on Vercel. The live product can be explored at BugChase.com; this case study intentionally describes the published product and implementation scope without publishing customer names, commercial figures, platform counts, payout totals, or performance claims.