PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The YesWeHack Bug Bounty Report 2025

yeswehack.com | blog | #bug-bounty | #open-source | #report | #trends | #cwe | #leaderboard
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

YesWeHack's first annual Bug Bounty report shares 2024 insights: most common CWEs, highest payouts, hunter leaderboards, a live-hacking-event recap, and Bug Bounty for open source.
Published
Collected

Related coverage

blog · yeswehack.com
YesWeHack report 2026: the trends, insights and strategic shifts shaping offensive security
The second annual YesWeHack report: AI's impact on CISOs and Bug Bounty hunters, the platform's MAP > TEST > FIX > COMPLY evolution, EU Commission testing expansion and hunter survey findings.
blog · yeswehack.com
Resilience through community: Looking forward to 2021
YesWeHack's 2020 retrospective: its community reached 20,000 ethical hackers and crowdsourced security became a new standard, with vulnerability trends shifting toward design and implementation flaws.
blog · portswigger.net
What are AppSec leaders prioritizing in 2021? The survey results are in
PortSwigger's survey of AppSec leaders finds 2020's rapid digital transformation expanding web estates and security concerns, with DevSecOps framed as an incremental journey rather than a destination.
blog · portswigger.net
The state of DevSecOps: the latest stats and trends in 2020
A statistical snapshot of DevSecOps in 2020: Gartner puts market penetration at 20-50%, most DevOps adopters are one to five years in, and only 15% consider their adoption fully mature.
blog · blog.trailofbits.com
SequenceHash: multihashing for the rest of us
We're releasing SequenceHash and its sister function SequenceMAC, a pair of related hash constructions that bring secure multihashing to developers using hash functions other than Keccak.
blog · blog.trailofbits.com
1Password's AI patching benchmark is misleading
Trail of Bits says 1Password's FLAWED benchmark misstates AI patch quality, mixing wrong-fix prompts and no-test trials into a 26% clean-fix headline, and ships two agent skills for better fixes.
Back