Panel: Let's Get 360 w/Bug Bounty!
summary
Panelists compare hunter, triage and company workflows and say communication is the biggest bottleneck, not tools. Hunters report spending from a few hours a week to ~20 hours weekly or full-time for a year; common tooling includes Burp Suite, CTF practice sites and one-click POC proofs. Triage asks for clear steps, CBSS scoring and sometimes video or network traces using video+network capture tools to reproduce. Companies prefer starting private then public, define scope and consider disclose.io style safe‑harbor language.
AI-written summary · about
chapters (18)
- 0:00Introduction and panel setup
- 2:10Hunters' hunting frequency
- 3:37How hunters started in bug bounties
- 6:47Issues with reporting vulnerabilities
- 11:03Convincing companies about vulnerabilities
- 13:30Improving bug bounty programs
- 19:06Advice for new bug bounty hunters
- 21:56Addressing bug bounty myths
- 22:38Handling out-of-scope submissions
- 23:46Triage and reproducibility challenges
- 26:11Platform vs company control in bug bounties
- 26:56Interesting bug bounty submissions
- 28:24Fears of bug bounty platforms
- 30:52Company budget and resource concerns
- 33:02Company-side triaging process
- 37:41Companies' fears about bug bounties
- 42:17Future of bilateral trust in bug bounties
- 46:56Future of bug bounty programs
related talks
15m"You've Got Your Nice List of Bugs, Now What?" Vulnerability Discovery and Management
52mPractical Tips For Running A Successful Bug Bounty Program
50mBug Bounty Programs: Successfully Controlling Complexity and Perpetual Temptation
55mYour License for Bug Hunting Season
25mPanel Discussion Led by – Joshua Corman
45mRunning an efficient bug bounty program and PSIRT... (Garrett McNamara, Jeff Guerra)
11mBuilding a Bug Bounty Program: From the Trenches
53mBounty Operations: Best Practices and Common Pitfalls to Avoid in the First 6-12 Months