Life of a Bug (an insight on the GitHub bounty...
summary
Shows how GitHub routes a HackerOne report through HackerOne intake into an automated Slack-driven workflow that creates a lead, runs slash-command prioritization, and spins a GitHub issue for the investigation. A mock IDOR against MonaHub affects GHES, triggers a CVE, coordinated release notes and notifications, and yields a suggested $10K payout (program awards up to $50K and has paid ~$3.9M over nine years). Postmortems, CodeQL/Sentinel detections and Copilot-assisted summaries close the loop.
AI-written summary · about
chapters (16)
- 0:00Introduction and speakers
- 0:42Bug bounty program overview
- 2:08Public and private programs
- 3:50Bug bounty scope and rewards
- 5:12Product security team overview
- 7:18Automation in security workflow
- 8:02Bug triage process
- 10:11Converting lead to investigation
- 11:57Investigation and CVE assignment
- 13:02Response and mitigation
- 14:27Notification and transparency
- 15:31Bounty payout and researcher credit
- 17:18Post-incident review
- 18:21Prevention and trend analysis
- 19:46Tips and takeaways
- 22:12Q&A session
related talks
04mAnother year of HackerOne statistics
31mData Driven Bug Bounty
42mHidden Chains: Revealing High-Impact Bugs from Bounty submissions
22mEngineering under the watchful eyes of hackers
46mHow to run a successful bug bounty programme
35mBug Bounty Hunting
45m2014.10.29 - Security@Scale - Katie Moussoris, HackerOne
55mYour License for Bug Hunting Season