PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How Governments are Running Effective Bug Bounty Programs

bugcrowd.com | incident | #bug-bounty | #vdp | #government | #safe-harbor | #dod | #hack-the-pentagon
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bugcrowd founder Casey Ellis highlights government bug bounty momentum, from the DoD's Hack the Pentagon to Switzerland's reward for hacking its e-voting system, citing safe harbor and VDP lessons.
Published
Collected

Related coverage

vulnerability · hackerone.com
HackerOne Congratulates the Department of Defense on 11K Vulnerability Reports
Three years after Hack the Pentagon, the US DoD's VDP has logged 11,000 valid vulnerabilities. Director Kris Johnson explains keeping a permanent reporting channel open across all DoD websites.
blog · hackerone.com
The Best is Yet To Come: DOD Awards New Hack the Pentagon Contract to HackerOne
The DoD's Defense Digital Service expanded Hack the Pentagon, awarding HackerOne a new contract for private bounties on sensitive internal systems after 5,000+ valid vulnerabilities in two years.
blog · hackerone.com
Bringing Private-sector Security into the U.S. Government [Security@ Recaps]
Security@ panel with Michael Chung (DDS) and Jacob Kaplan-Moss (18F) on importing private-sector security practices; Hack the Pentagon found 138 bugs in 4 weeks vs 30 in 3 years.
blog · hackerone.com
Hack The Pentagon Turns One on HackerOne
Hack the Pentagon's first year: 3,000+ vulnerabilities resolved—2,837 via the DoD's disclosure policy across ~40 components—with hackers earning $300,000+ in bounties from 50+ countries.
blog · hackerone.com
HACK THE PENTAGON AGAIN - AND AGAIN
After the success of its Hack the Pentagon pilot, the U.S. Department of Defense expands its bug bounty efforts and picks HackerOne and Synack for crowdsourced vulnerability discovery and disclosure.
blog · hackerone.com
What Was It Like To Hack the Pentagon?
Behind the scenes of Hack the Pentagon: the U.S. government's first bug bounty drew its first report within 13 minutes, accepted 1,400+ hackers and resolved 138 valid vulnerabilities over 24 days.
Back