Your License for Bug Hunting Season
summary
Bug bounty programs reduce risk by turning incidental attackers into paid reporters and by using concrete controls: a hosted intake platform with triage and normalization, identity verification and background checks, scoped rules of engagement that create safe harbor, and budgeted reward pools that start modest and scale. Expect the crowd to find impactful issues fast — 40,000 researchers producing critical vulnerabilities within 48 hours is typical — and use private invites, diluted project pools, and monitoring to limit rogue-actor and legal exposure.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:28Introductions
- 5:21Outline
- 12:05Shark analogy
- 14:29The reward
- 16:51The risk
- 20:43Survey results
- 22:18Bug bounty evolution
- 26:00Scale
- 32:07Brief
- 34:54Scope
- 36:14Budgeting
- 38:46Legal
- 40:20Rogue Hacking
- 44:59Questions
- 45:33Offensive vs Defensive
- 49:02Trust
related talks
50mBug Bounty Programs: Successfully Controlling Complexity and Perpetual Temptation
15m"You've Got Your Nice List of Bugs, Now What?" Vulnerability Discovery and Management
43mHard Knock Lessons On Bug Bounties
11mBuilding a Bug Bounty Program: From the Trenches
50mTo bounty, or not to bounty? Security@ insights from 500 organizations
40mDon't Let Bug Bounty Kill Your Appsec Posture
56mRunning a Bug Bounty Program @ SEEK
38mManaging for Success: Maintaining a Healthy Bug Bounty Program Long Term