Mailbox Connection Approval
Everything your IT team and management need to approve connecting a shared mailbox to Bugtri.
Business Case
What is Bugtri?
Bugtri is an AI-powered triage platform that automates the initial assessment of incoming vulnerability disclosure and bug bounty reports. It connects to a single shared mailbox (e.g. security@company.com) and processes incoming researcher reports through a privacy-preserving AI pipeline, delivering scored triage summaries back to the same mailbox.
Business Benefits
- Reduce manual triage time by up to 80% - AI scores and classifies each report automatically, so your security team only reviews what matters
- Respond to researchers faster - auto-responses acknowledge receipt immediately, improving your vulnerability disclosure programme's reputation
- Protect sensitive data - all URLs, IPs, email addresses, and domains are automatically stripped from reports before they reach any AI provider
- Maintain consistency - every report is scored against the same configurable criteria, eliminating analyst-by-analyst variation and subjective triage
- Filter AI-generated noise - identify and auto-decline low-quality, severity-inflated, and mass-submitted reports that waste analyst time
- Configurable and auditable - all scoring weights, thresholds, and auto-response templates are configurable per mailbox with a full audit trail
Data Handling & Privacy
Data Sanitisation
Before any email content reaches an AI provider, sensitive data (URLs, IPs, email addresses, domains) is replaced with safe placeholder tokens. Your infrastructure details never leave Bugtri's servers.
Bring Your Own AI Key
Bugtri uses your organisation's own AI API key (OpenAI, Anthropic, or Google Gemini). Data is processed under your terms with the provider. Reports are never used for model training.
Encryption
OAuth tokens encrypted at rest with AES-256-GCM. All data in transit uses TLS 1.2+. Passwords hashed with bcrypt. No plaintext credentials stored.
Data Retention
Configurable retention (7-365 days). Auto-purge available. Manual purge on demand. Option to exclude vulnerability details from stored data entirely.
Compliance
Bugtri is designed to meet: UK GDPR, EU GDPR, CCPA/CPRA, and the Australian Privacy Act 1988. Payment processing via Stripe (PCI DSS Level 1).
Access Scope
Bugtri only accesses the single mailbox that is explicitly authorised. It cannot access any other mailboxes, user accounts, contacts, calendar, files, OneDrive, Google Drive, or admin settings in your organisation. It does not send emails from your account or delete existing emails. Note: Google's consent screen describes the gmail.modify scope as allowing sending - this is a limitation of Google's scope model. Bugtri only uses this permission to apply organisational labels to processed emails.
Technical Requirements & Setup
Connection Method
Bugtri connects via OAuth 2.0 (industry-standard authorisation). No passwords are shared. The authorising user signs in to their email provider (Google or Microsoft) and grants Bugtri specific, limited permissions on a single mailbox only.
OAuth Permissions
The following permissions are requested via the provider's standard OAuth consent screen. They apply only to the specific mailbox account used to authenticate - Bugtri has no access to other mailboxes or accounts in the tenant.
Google Workspace (Gmail)
| OAuth Scope | Purpose | Access Level |
|---|---|---|
gmail.readonly | Read incoming vulnerability reports from this mailbox | Read only - single mailbox |
gmail.modify | Apply Gmail labels (e.g. Bugtri/Processed, Bugtri/Urgent) to organise processed emails. Google's consent screen describes this scope broadly as "read, compose and send" - Bugtri only uses it for labelling. | Labels only - Bugtri never sends or deletes |
openid, email | Identify which mailbox account was connected | Profile only |
Microsoft 365 (Outlook)
| OAuth Scope | Purpose | Access Level |
|---|---|---|
Mail.Read | Read incoming vulnerability reports from this mailbox | Read only - single mailbox |
Mail.ReadWrite | Move processed emails to a "Bugtri-Processed" folder within this mailbox | Move only - no send/delete |
openid, email, profile | Identify which mailbox account was connected | Profile only |
offline_access | Maintain the OAuth connection without requiring the user to re-authenticate | Token refresh only |
IT Admin Pre-Configuration: Google Workspace
The following steps should be completed by a Google Workspace Super Admin before the end user initiates the connection from Bugtri. These can be included in your ITSM change ticket as implementation tasks.
Google Workspace Admin Tasks
- Sign in to Google Admin Console (
admin.google.com) as a Super Admin. - Navigate to Security > Access and data control > API Controls.
- Under App access control, click Manage Third-Party App Access.
- Click Add app > OAuth App Name or Client ID.
- Search for Bugtri or enter the OAuth Client ID provided by Bugtri (available on request from support).
- Set the access level to Trusted. Optionally restrict to the specific organisational unit (OU) that contains the shared mailbox account.
- Click Configure and confirm.
IT Admin Pre-Configuration: Microsoft 365
The following steps should be completed by a Global Administrator or Application Administrator in Azure AD / Microsoft Entra ID before the end user initiates the connection.
Microsoft 365 / Entra ID Admin Tasks
- Sign in to the Azure Portal (
portal.azure.com) as a Global Administrator. - Navigate to Microsoft Entra ID > Enterprise Applications.
- Check Consent and permissions > User consent settings. If set to "Do not allow user consent", admin consent is required before the user can authorise Bugtri.
- Option A - Grant admin consent in advance:
- Go to Enterprise Applications > All Applications.
- If Bugtri does not appear, the user will need to initiate the connection first (Step 2.5 below), then return here.
- Once Bugtri appears, click it > Permissions > Grant admin consent for [Your Tenant].
- Review the requested permissions and click Accept.
- Option B - Allow user consent for verified publishers:
- Go to Consent and permissions > User consent settings.
- Select "Allow user consent for apps from verified publishers, for selected permissions".
- Ensure the permission classifications include:
Mail.Read,Mail.ReadWrite,openid,email,profile,offline_access.
- Optional - Restrict to specific users: Under the Bugtri enterprise application, go to Users and groups and assign only the shared mailbox account or specific users who should be able to connect mailboxes.
- Optional - Conditional Access: If your organisation uses Conditional Access policies, ensure they do not block OAuth token grants to third-party applications from the network/device the user will connect from.
End User Connection Steps
After IT admin pre-configuration (if required), the end user performs the following steps from their browser:
User Steps (both providers)
- Log in to Bugtri at
bugtri.com/login. - Navigate to Mailboxes from the sidebar.
- Click Connect Gmail or Connect Microsoft 365.
- Review the information in the connection guide modal and click Continue.
- Sign in to the shared mailbox account (e.g.
security@company.com) when prompted by Google/Microsoft. - Review the permissions on the consent screen and click Allow (Google) or Accept (Microsoft).
- You will be redirected back to Bugtri. The mailbox will show as "Connected" with a green indicator.
- Bugtri will begin monitoring the mailbox within 5 minutes. The first sync time will appear on the mailbox card.
Network & Firewall Requirements
Network Configuration
| Requirement | Detail |
|---|---|
| Inbound firewall rules | None required. Bugtri is fully cloud-hosted. |
| Outbound access | Bugtri servers connect outbound to Google/Microsoft APIs over HTTPS (port 443). |
| VPN / site-to-site | Not required. No on-premise components. |
| Agents / software | None. No software installed on any endpoint or server. |
| IP allowlisting | If your provider requires allowlisting for API access, contact Bugtri support for current egress IP ranges. |
| DNS changes | None required for mailbox connection. Optional: add Bugtri to SPF/DKIM if receiving triage emails from triage@bugtri.com. |
Revoking Access
Access can be revoked immediately by any of these methods:
| Method | Steps | Effect |
|---|---|---|
| From Bugtri | Mailboxes page > click Remove on the mailbox card | Mailbox disconnected. OAuth token deleted from Bugtri. |
| From Google Admin | Admin Console > Security > API Controls > Manage Third-Party App Access > Remove Bugtri | OAuth token revoked. Bugtri loses access immediately. |
| From Azure / Entra ID | Enterprise Applications > Bugtri > Properties > Delete | All consent revoked. Bugtri loses access to all mailboxes in the tenant. |
| From the mailbox user | Google: myaccount.google.com > Security > Third-party apps. Microsoft: myapps.microsoft.com > Bugtri > Revoke. | Individual user's OAuth token revoked. |
Once revoked, Bugtri immediately loses access. No further emails are read or processed. Existing triage data remains in Bugtri subject to the configured retention policy and can be purged on request.
Further Information
- Trust Centre - security architecture, compliance, and data controls
- Security Policy - encryption, authentication, infrastructure, and incident response
- Privacy Policy - data collection, processing, retention, and your rights
- Terms of Use - service terms including AI disclaimers and liability
- Contact Us - for technical questions or to request a security review