PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How Security Researchers and Bug Bounty Programs Can Build Lasting Partnerships

hackerone.com | research | #bug-bounty | #best-practices | #program-management | #collaboration | #hackerone | #security-researchers
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Lasting bug bounty success comes from relationships: programs should clarify priorities in overviews, while researchers who study program guidelines closely uncover higher-impact vulnerabilities.
Published
Collected

Related coverage

research · hackerone.com
PayPal on Creating Strong Relationships with Security Researchers
PayPal's bug bounty team has awarded over $6 million to some 3,000 hackers since 2012, and shares lessons on researcher relationships: open feedback, transparency, and objective CVSS-based rewards.
research · portswigger.net
Responsible denial of service with web cache poisoning
James Kettle shows how web cache poisoning can take down websites with a single request without collateral damage, earning bounties from Tesla and HackerOne along the way.
research · projectblack.io
We can't set up the conversation because your organisations are not set up to talk to each other
Troubleshooting the Teams cross-org chat error: it stems from the External access setting, and the fix is usually adding the other organisation's domain to the allow list in the Teams admin center.
research · bugcrowd.com
How to Write a Clear and Thoughtful Scope, A Deep Dive
Bugcrowd's scoping deep dive explains how ambiguous bounty brief scope leads researchers to under-test or over-test, urging explicit in-scope assets and exclusions in every bug bounty brief.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · projectdiscovery.io
PHP2Shell: finding and patching affected PHP
Two CVSS 9.2 bugs in the PHP runtime allow unauthenticated code execution; the patch is a package upgrade and a restart, and this guide shows how to find every PHP runtime you need to patch.
Back