PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

GitLab’s Public Bug Bounty Program Kicks Off: Q&A with GitLab’s Kathy Wang & James Ritchey

hackerone.com | vulnerability | #bug-bounty | #gitlab | #open-source | #vdp | #interview | #hackerone
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

GitLab launched its public bug bounty program, following a private program and public VDP that resolved 250 vulnerabilities and paid $194,700. Security director Kathy Wang explains the evolution.
Published
Collected

Related coverage

vulnerability · yeswehack.com
Vulnerability Disclosure Policy through the eyes of a bug hunter
An interview with ethical hacker Clement 'SaxX' Domingo on what a Vulnerability Disclosure Policy is, how it differs from bug bounty programs, and why few companies have set one up.
blog · hackerone.com
Critical PHP Vulnerabilities: What Security Teams Need to Know
Learn about the critical PHP vulnerabilities, HackerOne’s response, and the rise in reports. Review patching guidance and coordinated disclosure practices.
blog · about.gitlab.com
Building AI security in the open
GitLab has joined the Open Secure AI Alliance to help advance transparent, adaptable approaches to securing AI systems.
blog · tenzai.com
An open-weight model powered the #1 HackerOne VDP research operation
Tenzai's AI hacker topped the world's largest bug bounty leaderboard on GLM 5.2, a model anyone can download, and the offensive capability once limited to a few frontier labs is now within anyone's reach.
vulnerability · about.gitlab.com
Pillow CVE-2026-112900: How to find and fix it with GitLab
Upgrade to Pillow 13.0.0, then use dependency scanning, code search, and GitLab Duo Agent Platform to patch every affected Python project in your groups.
vulnerability · yeswehack.com
OpenAI VDP for bugs found by AI, CVE funding fears persist, ‘shift left’ towards vulnerability overload – OffSec roundup for CISOs
Roundup: OpenAI's outbound VDP for bugs found by its AI, persistent CVE/NVD funding fears, 'shift left' vulnerability overload, and why Mikko Hyppönen now focuses on drones.
Back