A data processing method comprising: using a computer, inviting a distributed plurality of researcher computers to participate in one or more computer vulnerability research projects directed to identifying computer vulnerabilities of one or more systems that are owned or operated by a third party; using the computer, assigning a particular computer vulnerability research project, relating to a particular system under test, to a particular researcher computer from among a subset of the researcher computers; using control logic that is logically interposed between the particular researcher computer and the particular system under test, monitoring networked data communications between the particular researcher computer and the particular system under test, wherein the communications relate to attempting to identify a candidate security vulnerability of the particular system under test; receiving, by the control logic, a report of the candidate security vulnerability from the particular researcher computer; evaluating and validating, by the control logic, the reported candidate security vulnerability of the particular system under test that is received from the particular researcher computer, the evaluating and validating comprising: deduplication, which involves checking whether another researcher has previously reported a security vulnerability that is identical or similar to the candidate security vulnerability, the deduplication comprising performing a literal or fuzzy comparison of values received in the report to records of the security vulnerability reported by the another researcher; and validating the report of the candidate security vulnerability by attempting to duplicate the candidate security vulnerability; and in response to determining that the evaluating and validating was successful, performing, by the control logic, one or more remediation operations on the particular system under test based at least in part upon the report. using a computer, inviting a distributed plurality of researcher computers to participate in one or more computer vulnerability research projects directed to identifying computer vulnerabilities of one or more systems that are owned or operated by a third party; using the computer, assigning a particular computer vulnerability research project, relating to a particular system under test, to a particular researcher computer from among a subset of the researcher computers; using control logic that is logically interposed between the particular researcher computer and the particular system under test, monitoring networked data communications between the particular researcher computer and the particular system under test, wherein the communications relate to attempting to identify a candidate security vulnerability of the particular system under test; receiving, by the control logic, a report of the candidate security vulnerability from the particular researcher computer; evaluating and validating, by the control logic, the reported candidate security vulnerability of the particular system under test that is received from the particular researcher computer, the evaluating and validating comprising: deduplication, which involves checking whether another researcher has previously reported a security vulnerability that is identical or similar to the candidate security vulnerability, the deduplication comprising performing a literal or fuzzy comparison of values received in the report to records of the security vulnerability reported by the another researcher; and validating the report of the candidate security vulnerability by attempting to duplicate the candidate security vulnerability; and deduplication, which involves checking whether another researcher has previously reported a security vulnerability that is identical or similar to the candidate security vulnerability, the deduplication comprising performing a literal or fuzzy comparison of values received in the report to records of the security vulnerability reported by the another researcher; and validating the report of the candidate security vulnerability by attempting to duplicate the candidate security vulnerability; and in response to determining that the evaluating and validating was successful, performing, by the control logic, one or more remediation operations on the particular system under test based at least in part upon the report.