Bugcrowd University is Bugcrowd's free training for the researchers on its platform. The structured part lives on GitHub: roughly ten modules, each with slides, a recorded talk and sometimes a lab guide, covering an introduction to the platform, how to write a good submission, Burp Suite basics and advanced use, broken access control, XSS, SSRF, XXE, recon and GitHub-based sensitive data exposure. It is licensed CC BY 4.0, which is generous. The best module is the one about submissions. Bugcrowd triages a huge volume of reports, and the advice on reproduction steps, impact and not overclaiming severity comes from people who read bad reports all day.
New hunters lose a lot of payouts to poor write-ups, and this fixes that quickly. The rest is decent but uneven. The web modules are fine introductions, but PortSwigger's Web Security Academy covers the same bugs with far better labs. The module list has shown later entries as to be determined for a long time, which tells you this is not an actively growing curriculum. The Bugcrowd University web page mixes the training with eBooks, analyst reports and product datasheets, so you have to dig. On AI, there is a mismatch.
Bugcrowd sells AI pen testing and runs AI bias and LLM programs for customers, but the university has very little to teach researchers how to test those targets. That feels like a missed opportunity, given the demand. My take: a solid free supplement, especially for the report-writing advice. It is not a place to learn from zero.