PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

What Is a Bug Bounty? Should You Offer One? And How To Do It

hackerone.com | vulnerability | #bug-bounty | #vulnerability-management | #vulnerability-disclosure | #security-testing | #responsible-disclosure | #best-practices | #security-program | #scope | #program-management | #security-programs | #program-scope | #program-design
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A primer on bug bounties: how public and private programs work, what makes a good scope and vulnerability report, and when to add bounties to your vulnerability management strategy.
Published
Collected

Related coverage

vulnerability · projectdiscovery.io
Bug Bounty Etiquette: More than Ethical Hacking (part one)
Part one of the bug bounty etiquette series covers the dos: always get permission before testing, stay in scope, be transparent, and take your time—soft skills that build reputation and career.
blog · depthfirst.com
Our Approach to Coordinated Vulnerability Disclosure
depthfirst's coordinated disclosure policy: every report is human-verified and includes a PoC and fix guidance; vendors get 30 days to patch, then a 7-day adoption window before publication.
blog · projectdiscovery.io
Bug Bounty Etiquette: Our Guide to Polite Hacking (Part Two)
Part two of the etiquette series: don't flood targets with aggressive scans that trip IDS or risk DoS, don't ignore program rules or forbidden tools, don't submit noise, and don't beg for rewards.
blog · netspi.com
3 Fundamentals for a Strong Cloud Penetration Testing Program
Building a cloud pentesting program starts with secure design, accounts for the shared responsibility model, and avoids assuming cloud services are secure by default, per NetSPI.
blog · projectzero.google
Feedback and data-driven updates to Google’s disclosure policy
A Google Project Zero announcement on feedback and data-driven updates to Google's vulnerability disclosure policy.
blog · netspi.com
Vulnerability Disclosure Submission Standard?
The author argues the industry lacks a standard vulnerability disclosure channel and proposes RFC2142 mailboxes such as security@ and abuse@ as a simple convention for routing reports.
Back