Does Public Disclosure of Vulnerabilities Affect Hacker Participation in Bug Bounty Programs?
summary
Scrapes of HackerOne produce a panel dataset (~368 programs, 2012–2021, ~830k closed reports, ~8k publicly disclosed, ~6,000 hackers) and the main claim is clear: higher rates of valid public disclosures correlate with fewer bug resolutions in subsequent months and lower success for experienced hackers — evidence consistent with cognitive fixation. Noise or invalid disclosures show no effect. Severe, critical disclosures boost future discoveries, and frequent program switching by hunters reduces fixation.
AI-written summary · about
chapters (15)
- 0:00Bug bounty research intro
- 2:29Questioning vulnerability disclosure impact
- 3:56Hacker behavior and disclosure
- 6:03Cognitive fixation in hacking
- 10:47HackerOne data collection
- 13:16Modeling disclosure effects
- 15:03Disclosure and hacker success
- 17:57Critical bugs disclosure benefits
- 19:27Q&A: Company factors
- 21:31Q&A: Severe vulnerability disclosure
- 22:58Q&A: Platform and feedback
- 24:02Q&A: Data anomalies
- 25:27Q&A: Fixation vs avoidance
- 27:57Q&A: Private programs
- 30:02Closing remarks
related talks
04mAnother year of HackerOne statistics
12mAre Users Able to Take Control of Their Data?
55mYour License for Bug Hunting Season
15m"You've Got Your Nice List of Bugs, Now What?" Vulnerability Discovery and Management
56mHow Building a Better Hacker Accidentally Built a Better Defender
31mA Glimpse Into OSS Vulnerability Disclosure Practices
50mTo bounty, or not to bounty? Security@ insights from 500 organizations
41mWhat the Hack: A Personal Story about Ethical Hacking