Hard Knock Lessons On Bug Bounties
summary
Data shows 30,000 submissions with 765 high/critical reports and 222 criticals, 30,000 submissions leading to an average payout per valid issue near $200 and a top payout of $13,500. Platforms like Bugcrowd validate at scale; expect ~66% duplicates, ~20% valid, private programs cut duplicates toward ~30%. Run Burp Suite before launch, budget for 30–120 day fixes, staff to triage thousands of reports, and adopt a 60‑day abandonment policy for unresolved validated issues.
AI-written summary · about
chapters (18)
- 0:00Hard Knock Lessons On Bug Bounties
- 2:06UNIVERSITY RAPID
- 5:212,888 Paid submissions (all time)
- 8:28First things first
- 9:03You're going to want to make friends with legal
- 15:00What is in scope?
- 16:16How bulletproof is your scope?
- 19:34Preparing the brief
- 21:49Sample Public Program
- 23:05Sample Private Program
- 23:45Public programs
- 26:39When expectations aren't
- 29:12How will you reward useful but out of scope submissions?
- 33:21Can you reproduce the issue?
- 34:25Handling upstream issues
- 35:35What about swag rewards?
- 36:01When are you going to payout?
- 37:53Bumping rewards
related talks
30mBeyond Quick Cash: Rethinking Bug Bounties for...
56mRunning a Bug Bounty Program @ SEEK
55mYour License for Bug Hunting Season
50mBug Bounty Programs: Successfully Controlling Complexity and Perpetual Temptation
04mAnother year of HackerOne statistics
20mGetting to $10,000 – the variables at play in determining bounty awards
52mPractical Tips For Running A Successful Bug Bounty Program
37mFrom DevSecOops to Security Success: The Bug Bounty Effect at FINN.no