Program settings let you control how your program is discovered, who can participate, and what researchers can see once they have access. Using these settings consistently helps you manage submission volume, researcher expectations, and program security.
Manage settings
⚙️Roles: Company Admin, Program Admin
You can manage your program settings by opening your program and going to More > Settings.
Program confidentiality
Program confidentiality defines who can discover your program and who is allowed to participate. Choosing the right confidentiality level helps you control visibility, manage risk, and gradually scale researcher access as your program matures.
Learn more about program confidentiality levels (Invite Only, Application, Registered, Public).
Program status
The program lifecycle reflects the different stages a program goes through on the Intigriti platform, from initial setup to final closure.
Learn more about program states (Wizard, Draft, Open, Suspended, Closing, Closed) here.
Identity checked only
When ID-checking is enabled, only researchers who have completed the ID verification process can participate in your program.
⚠️Beware: The ID check requirement is not compatible with public programs. When ID-checking is enabled, you cannot change the program confidentiality level to Public. Likewise, if a program is already Public, the ID-checking requirement cannot be enabled.
Not all researchers on the platform are ID-checked. Keep in mind that all researchers who wish to receive a payout must complete ID checking, regardless of this setting. Enabling ID-checking at program level helps ensure that only verified researchers can submit findings from the start.
Area specific restrictions - EEA
The area restriction for EEA residents is a program setting that limits participation to researchers who are ID-checked and indicate they reside within the European Economic Area. This setting acts as an additional safeguard on top of the ID-check requirement.
Once enabled, the program is visible only to researchers who meet both requirements. Researchers who are not ID-checked or who do not state EEA residency cannot find the program anywhere on the platform.
When inviting researchers, an EEA residents only filter is automatically applied. This hides all researchers who do not meet the EEA requirement. The restriction can be overridden at invite level, allowing administrators to invite non-EEA researchers after a double confirmation. Use this option carefully, as it bypasses the area restriction for individual invites.
Enforce two-factor authentication
Enforcing two-factor authentication adds an extra layer of security and confidentiality to your program by allowing access only to researchers who use 2FA when logging in.
When enabled, only researchers with 2FA configured can fully access your program. Researchers without 2FA can view only the program description and bounty table and cannot access the full program details. You cannot invite researchers who do not have 2FA enabled.
If you enable this setting on an ongoing program, researchers who previously had access will regain full access as soon as they enable 2FA on their account.
💡Note: This setting is recommended for programs with higher sensitivity or stricter security requirements.
Terms & conditions
By default, all researchers must adhere to Intigriti’s standard Terms and Conditions and Code of Conduct. These apply automatically to every program and generally cover the needs of most organizations.
If required, you can enforce additional custom terms and conditions. This is typically driven by legal requirements. The text for the additional terms is defined in the Admin section of the platform and can then be enabled per program. This allows you to apply extra terms to some programs while leaving others unchanged.
Once enabled, only researchers who have accepted your custom terms and conditions can access your program. Researchers who have not yet accepted them cannot see any program details.
💡Note: Additional terms introduce extra barriers to participation. In most cases, keeping only the standard Terms and Conditions and Code of Conduct helps maximize researcher engagement.
Researcher collaboration
Researcher collaboration allows researchers to work together on submissions and split the bounty.Allowing collaboration can lead to higher-quality findings by combining different skill sets.
💡Note: It's recommended to allow collaboration unless your reward structure cannot easily be split between multiple contributors.
Program listing
The program listing setting allows you to further control this visibility by deciding whether a public program should appear across the platform and public website, or remain accessible only through its direct program URL.
Learn more about unlisted programs.
Statistics visibility
Statistics visibility controls whether total payout, average payout, number of submissions created and accpeted are shown on your program details page to researchers.
Leaderboard confidentiality settings
Leaderboard confidentiality settings control who can see individual researcher reputation points. The leaderboard itself is visible to researchers who can access the program, but this setting determines whether the actual reputation points are visible to everyone, the circle of trust (participating researchers) or nobody.
💡Note: Hiding leaderboard reputation points can help prevent researchers from estimating how much others may have been rewarded. This is especially useful shortly after launching a program.
Best practices
Choose a confidentiality level that matches your program maturity. Start with Invite Only or Application to control early access, then expand visibility as your scope, processes, and remediation capacity mature.
Use ID checking and EEA restrictions thoughtfully. These settings increase trust and compliance but also reduce the available researcher pool, which can impact submission volume.
Enforce 2FA for sensitive scopes. Programs with production data, high business impact, or strict security requirements benefit most from requiring two-factor authentication.
Avoid adding custom terms unless legally required. Additional terms increase friction and can reduce researcher participation and submission quality.
Enable researcher collaboration whenever possible. Allowing researchers to collaborate often leads to higher-quality reports and faster discovery of complex vulnerabilities.
Review visibility settings before launch. Leaderboard visibility, statistics visibility, and unlisting options can influence researcher behavior and expectations, especially during the first weeks of a program.
Related articles