Engineering under the watchful eyes of hackers
summary
HackerOne protects a platform used by a community of ~700,000 hackers and that has paid out over $100M in bounties by embedding over 25 concrete methods into the devops lifecycle: mandatory peer code review, linters/analyzers, Renovate for dependency updates, Detectify/Qualys/Nessus and AWS Inspector scans, and a public bug bounty that finds ~700 valid vulnerabilities on the platform (≈$400k paid for those). Authorization uses ACLs and a protector pattern; deployments go through Nile Slack plugin and production access is via a redacted Looker replica and peer-reviewed production requests.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 1:10Context
- 3:17Secure Coding
- 10:03Build Step
- 12:53Looker Database
- 14:33Production Requests
- 16:11Other Strategies
related talks
26mLife of a Bug (an insight on the GitHub bounty...
56mHow Building a Better Hacker Accidentally Built a Better Defender
12mAre Users Able to Take Control of Their Data?
29mBuilding a Hackbot: How Ethiack's Hackian Finds Real Vulnerabilities
43mApplication Security is a Community Effort
16mThe hacker army protecting your data
41mWhat the Hack: A Personal Story about Ethical Hacking
48mImproving the Security of a Large Open Source Project One Step...