How To Use Bug Bounty To Start A Career In Silicon Valley

on YouTube ↗46m

" summary

Background includes NSA work, early Synack triager and running Facebook’s bounty program; advice focuses on concrete steps: learn OWASP Top 10, follow a testing methodology, use HackerOne/Bugcrowd/Synack, practice on Damn Vulnerable Apps and Google’s Patch Reward projects, and study the Graph API explorer case that yields $27k bugs and Facebook’s $10k payment to a 10‑year‑old. Emphasizes automating painful manual workflows, submitting fixes (Google pays extra), treating reports professionally, and proving both finding and fixing skills to get hired.

AI-written summary · about

" chapters (24)

1. 0:00Introduction and speaker background
2. 1:07Speaker's career journey to bug bounty
3. 3:54What is bug bounty and why it matters
4. 6:00Starting in bug bounty: basics and methodology
5. 9:11Avoiding scanner traps in bug bounty
6. 13:00Sandboxes and learning environments
7. 14:04Choosing bug bounty programs wisely
8. 16:30Building reputation for private programs
9. 17:11Advanced programs and depth over volume
10. 18:56Tracking knowledge gaps for growth
11. 20:21Understanding bug impact beyond CVSS
12. 22:26Demonstrating expertise like Philippe
13. 24:35From bug finder to security engineer
14. 28:05Importance of source code access
15. 30:10Learning software engineering for security
16. 32:35Open source contributions and rewards
17. 34:20Writing and publishing detailed bug reports
18. 35:46Mentoring and communication skills
19. 37:08Professionalism in bug bounty submissions
20. 39:11Treating bug bounty like a real job
21. 42:19Language and communication in security
22. 43:03Raj's checklist for success
23. 44:28Silicon Valley as a goal vs. global opportunity
24. 45:29Q&A and closing remarks

" related talks

• 52mPractical Tips For Running A Successful Bug Bounty ProgramGrant McCracken, Daniel Trauner · AppSecUSA 2016
• 11mBuilding a Bug Bounty Program: From the TrenchesYogesh Badwe · RSA Conference 2018
• 50mBug Bounty Programs: Successfully Controlling Complexity and Perpetual TemptationCassio Goldschmidt, Michael Gallagher, Sean Martin, Sean Melia, Michael Stoker · AppSec USA 2017
• 07mLessons learned from running big bug bounty programsKatie Moussouris · O'Reilly Security Conference 2016 - Amsterdam, Netherlands
• 35mSetting up a bug bounty program for your appSebastian Porst · droidCon Berlin 2019
• 56mRunning a Bug Bounty Program @ SEEKJulian Berton · NDC Sydney 2017
• 46mSetting up a bug bounty program for your appSebastian Porst · droidcon NYC 2019
• 40mBreaking the Box: How Emerging Technology Can Close the Cyber Skills GapDiana Kelley, Deveeshree Nayak · RSAC 2021