Managing for Success: Maintaining a Healthy Bug Bounty Program Long Term
summary
Advice on running a long‑term bounty program: set clear scope and changelogs, publish known issues, and uplift payout bands as the product hardens (example: initial top payouts around $1,500 should rise over years). Mix rewards: cash, swag, Hall of Fame and leaderboards, plus collaboration invites and 50–200 person on‑site hackathons. Measure triage and payout latency, pay partial rewards before a fix, and keep transparent, human communication to retain researchers and reduce duplicate or low‑value noise.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 2:00Welcome
- 4:45Cash Rewards
- 14:30Relationships
- 15:15Researchers
- 16:00Transparency
- 19:19Communication
- 21:51Keeping it Fresh
- 23:34Expectations
- 26:42Rewards
- 28:16Relationship Management
- 32:57sarcasm and snark
- 34:25Dont send
- 34:36Feedback
- 36:18Conclusion
- 36:38Outro
related talks
52mPractical Tips For Running A Successful Bug Bounty Program
50mBug Bounty Programs: Successfully Controlling Complexity and Perpetual Temptation
11mBuilding a Bug Bounty Program: From the Trenches
45mThe Good, the Bad, and the Bounty: 10 Years of Buying Bugs at Microsoft
30mBeyond Quick Cash: Rethinking Bug Bounties for...
46mHow to run a successful bug bounty programme
15m"You've Got Your Nice List of Bugs, Now What?" Vulnerability Discovery and Management
50mTo bounty, or not to bounty? Security@ insights from 500 organizations