PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Better than Cyber Monday: Ecommerce and Retail Edition of The Hacker-Powered Security Report

hackerone.com | blog | #bug-bounty | #ecommerce | #retail | #benchmarks | #security-report | #hacker-powered-security
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

The Hacker-Powered Security Report's ecommerce and retail edition: programs doubled two years running, critical bounties run 80% above cross-industry levels, retailers rank third in bounties paid.
Published
Collected

Related coverage

blog · hackerone.com
3 Bug Bounty Lessons From Retail & eCommerce Customers
HackerOne shares lessons from retail and eCommerce customers—where reflected XSS exceeds the all-industry average—and how diverse hacker skillsets and actionable insights speed up fixes.
blog · hackerone.com
Key Findings From The Hacker-Powered Security Report: Security Vulnerabilities Worry Companies the Most (6 of 6)
Last of six findings: 73% of surveyed companies worry about vulnerabilities being exploited, and 95% of 600 HackerOne customers would recommend hacker-powered security — now a best practice.
blog · hackerone.com
Key Findings From The Hacker-Powered Security Report: Bounty Payments Are Increasing (4 of 6)
Key finding #4: the average critical bounty rose 16% to $1,923 in 2017; top programs pay out roughly $50,000 monthly, and 88 bounties above $10,000 were awarded in a year as targets hardened.
blog · hackerone.com
Key Findings From The Hacker-Powered Security Report: It’s Not Just For Tech (1 of 6)
Key finding #1: over 40% of bug bounty programs launched in 2016 came from outside tech — governments, media, finance and retail all grew, with transport and retail each passing $1M in bounties paid.
blog · bugcrowd.com
Top Ecommerce Bugs and What They Mean
Retail and ecommerce programs tripled in 2018, with 29% of submissions critical. Top issues: server misconfiguration with default credentials, broken authentication, and sensitive data exposure.
vulnerability · hackerone.com
Key Findings From The Hacker-Powered Security Report: Vulnerability Disclosure Policies (5 of 6)
Key finding #5: 94% of top public companies still lack known vulnerability disclosure policies, unchanged since 2015 despite federal recommendations; as everything connects, VDPs are table stakes.
Back