RootBounty has no mailboxes of its own. Everything reaches you in two places: inside the platform and at the email address of your account.
A notification is created when something that concerns you happens: a new report or comment, a status change, a bounty, a disclosure request, a decision about your company or program, an invitation to sign a report.
no-reply@rootbounty.com. That address does not read replies.Companies can also receive their notifications in Slack, Discord, Microsoft Teams, Google Chat or their own system, in Settings → Integrations (see Getting started as a company). Everyone on a company's team receives the company's notifications.
Emails never contain the details of a report: they tell you what happened and link to the platform, where you sign in with two factors to read it.
The envelope in the header opens your messages: private conversations between your account and the RootBounty team.
Never describe an unfixed vulnerability in a message. Vulnerabilities in a program go in a report;
vulnerabilities in RootBounty itself follow the security policy.
There are no direct messages between users. Researchers and companies talk in the comments of each report, which keeps the whole history of a finding in one place and visible to everyone working on it.