PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Bug Bounty Platforms [Best Choices For a Bug Bounty Program]

hackerone.com | blog | #bug-bounty | #vulnerability-disclosure | #responsible-disclosure | #security-program | #program-management | #security-programs | #bug-bounty-platform | #platforms | #public-programs | #security-platforms | #platform-comparison
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Explains what a bug bounty platform does, how public and private programs differ in scope and submissions, and which features to weigh when choosing where to run a program.
Published
Collected

Related coverage

blog · depthfirst.com
Our Approach to Coordinated Vulnerability Disclosure
depthfirst's coordinated disclosure policy: every report is human-verified and includes a PoC and fix guidance; vendors get 30 days to patch, then a 7-day adoption window before publication.
blog · projectzero.google
Feedback and data-driven updates to Google’s disclosure policy
A Google Project Zero announcement on feedback and data-driven updates to Google's vulnerability disclosure policy.
blog · netspi.com
Vulnerability Disclosure Submission Standard?
The author argues the industry lacks a standard vulnerability disclosure channel and proposes RFC2142 mailboxes such as security@ and abuse@ as a simple convention for routing reports.
vulnerability · hackerone.com
What Is a Bug Bounty? Should You Offer One? And How To Do It
A primer on bug bounties: how public and private programs work, what makes a good scope and vulnerability report, and when to add bounties to your vulnerability management strategy.
blog · hackerone.com
Report Smarter, Not Harder: HackerOne's Case for Better CIRCIA Rules
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · hackerone.com
FanDuel’s Liam Somerville on Prioritising Researchers as an Extension of the Security Team
FanDuel's seven-person security team treats bug bounty researchers as an extension of itself. The program has resolved about 85 vulnerabilities and paid over $35,000, says Liam Somerville.
Back