PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

What is a Bug Bounty Program?

bugcrowd.com | blog | #bug-bounty | #bugcrowd | #crowdsourced-security | #vulnerability-disclosure | #triage | #basics | #ethical-hacking
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bug bounty programs reward ethical hackers for responsibly reporting vulnerabilities, with payouts scaled to severity. Most run through managed platforms that handle validation, triage, and payment.
Published
Collected

Related coverage

blog · bugcrowd.com
The hidden cost of agentic pentesting
Bugcrowd finds agentic pentesting tools submit overwhelmingly low-signal reports on public bug bounty programs, while top findings still come from skilled humans; triage absorbs the hidden cost.
blog · yeswehack.com
‘Having humans in the loop’: Crédit Agricole Personal Finance & Mobility on the value of Bug Bounty
Security leaders from Crédit Agricole Personal Finance & Mobility explain how they scoped their bug bounty program, the value of crowd diversity and triage, and plans for AI-related scopes.
blog · yeswehack.com
Scaling Bug Bounty triage in the AI era
How YesWeHack scales Bug Bounty triage as AI floods programs with reports: a six-step workflow pairs targeted AI support with certified experts to validate each submission before it reaches customers.
blog · yeswehack.com
Swiss Post launches public Bug Bounty program with YesWeHack
Swiss Post opened its bug bounty to YesWeHack's 23,000 hackers after a private program found 500 vulnerabilities and paid nearly CHF 250,000, with up to €10,000 per critical bug across 11 scopes.
blog · ethiack.com
Pentesting no more: Why it's time to move from Pentesting to Ethical Hacking
Opinion piece: checklist-driven pentesting gives a false sense of security; the industry should move to continuous ethical hacking, as modeled by bug bounty and disclosure programs.
vulnerability · bugcrowd.com
Bugcrowd Announces the Availability of Self-Service Vulnerability Disclosure Programs
Bugcrowd launches self-service Vulnerability Disclosure Programs: a structured intake and triage pipeline for bug reports, with managed triage for the first 15 or 75 submissions.
Back