PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

3 Bug Bounty Lessons From Retail & eCommerce Customers

hackerone.com | blog | #bug-bounty | #vulnerability-management | #xss | #case-study | #hackerone | #ecommerce | #retail
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

HackerOne shares lessons from retail and eCommerce customers—where reflected XSS exceeds the all-industry average—and how diverse hacker skillsets and actionable insights speed up fixes.
Published
Collected

Related coverage

blog · hackerone.com
Better than Cyber Monday: Ecommerce and Retail Edition of The Hacker-Powered Security Report
The Hacker-Powered Security Report's ecommerce and retail edition: programs doubled two years running, critical bounties run 80% above cross-industry levels, retailers rank third in bounties paid.
blog · bugcrowd.com
Top Ecommerce Bugs and What They Mean
Retail and ecommerce programs tripled in 2018, with 29% of submissions critical. Top issues: server misconfiguration with default credentials, broken authentication, and sensitive data exposure.
blog · hackenproof.com
Inside American Express India's Cloud Storage Exposure
An open MongoDB exposed 3M American Express India records, including Aadhaar and PAN numbers. What happened, and does Amex run a bug bounty today?
blog · hackerone.com
Measuring The Fix: How We Evaluate Frontier Models on Remediation Quality
HackerOne tested frontier models on security fix quality and found the judge mattered more than the model. See how CTEM remediation earns engineer trust.
blog · hackerone.com
Critical PHP Vulnerabilities: What Security Teams Need to Know
Learn about the critical PHP vulnerabilities, HackerOne’s response, and the rise in reports. Review patching guidance and coordinated disclosure practices.
blog · hackerone.com
Project Glasswing: What We Learned Running a Frontier Model on Our Own Codebase
HackerOne ran Anthropic's Mythos 5 model against its own production code; it surfaced a critical RCE spanning three safe-in-isolation commits, illustrating compositional risk that diff review misses.
Back