PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Why Ethics Matter in Bug Bounties

bugcrowd.com | incident | #bug-bounty | #extortion | #data-breach | #ethics | #disclosure | #uber-breach
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Using the Uber breach as a case study, Bugcrowd argues that paying hackers to stay silent is extortion, not a bug bounty, and that organizations have a legal duty to disclose breaches.
Published
Collected

Related coverage

blog · bugcrowd.com
The Uber Breach: Extortion Does Not Equal Bug Bounty
Bugcrowd CSO David Baker clarifies that bounties pay for in-scope vulnerability findings, while Uber's concealed $100,000 payment was extortion, and failing to report the breach violated the law.
incident · hackenproof.com
French Data Breach: MisterTemp Job Agency Exposed Millions of Records
An unprotected Elasticsearch cluster exposed 2.9 million French job-seeker records, including ID documents—what happened, and why the same company was breached again in 2026.
incident · bishopfox.com
The Latest in Ransomware: A Path of Cyber Destruction
A 2022 ransomware roundup tracing the RaaS ecosystem: Hive actors alone victimized over 1,300 companies for about $100 million, while Conti and REvil morphed into affiliates like Black Basta.
incident · hackerone.com
Breach Basics: Preparation for the Inevitable
HackerOne CISO Alex Rice's breach-response basics: prepare before incidents, answer what/how/when/who, weigh notification duties—plus a note on the platform's confidentiality policy.
incident · hackerone.com
Ethical considerations of access to the HackerOne community
HackerOne explains how it decides which organizations may use its platform, prompted by spyware vendor FlexiSPY's attempt to move its bug bounty program there; the post lays out arguments on both sides and its ethical position.
incident · hackenproof.com
LinkedIn Data Breach: 66 Million Scraped Records Exposed in an Unsecured Database
An open MongoDB database exposed 66 million scraped LinkedIn profiles—what was taken, whether scraping like this is legal, and how it compares to LinkedIn's larger 2021 incident.
Back