PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

What is your program’s Scope?

hackerone.com | vulnerability | #product-launch | #scope | #program-management | #hackerone | #vulnerability-taxonomy
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

HackerOne launches structured Scope management: programs list Assets (attack surfaces) under its severity taxonomy, shown on profiles and report forms so hackers know what is in and out of scope.
Published
Collected

Related coverage

blog · hackerone.com
Bug Bounty or Bust! Crafting Your Security Page
A guide to crafting a bug bounty program's security page: clearly scoping in- and out-of-scope assets, setting bounty and response expectations, and building trust that attracts top hackers.
vulnerability · hackerone.com
What Is a Bug Bounty? Should You Offer One? And How To Do It
A primer on bug bounties: how public and private programs work, what makes a good scope and vulnerability report, and when to add bounties to your vulnerability management strategy.
vulnerability · hackerone.com
$20,000,000: Time to split bounties!
HackerOne launches bounty splitting, letting hackers share payouts with collaborators who helped find a bug; the beta ships in select programs, enabled via the 'Manage Collaborators' link in a report.
vulnerability · hackerone.com
Introducing CWE-based Weaknesses
HackerOne replaces its original 18 vulnerability types with a taxonomy based on the Common Weakness Enumeration (CWE): 100+ weaknesses and 20+ clusters, mappable to OWASP Top 10 and compatible with external tools and customer taxonomies.
vulnerability · hackerone.com
Security Leads Share Bug Bounty Program Tips
Tips from a panel of security leads: treat top hackers as contractors or hires, publish explicit reward structures, start with tight scope, and pair bounties with targeted penetration tests.
vulnerability · yeswehack.com
9 rules for a successful first-time Bug Bounty Program
Nine rules for a successful first Bug Bounty program: clear team roles, a dedicated manager, a detailed brief, efficient triage, transparent payments and integration with internal remediation.
Back