Bug Bounty Programs: Successfully Controlling Complexity and Perpetual Temptation

on YouTube ↗50m

" summary

Start a program start private with vetted researchers (HackerOne/Bugcrowd can supply invite lists), define tight scope and SLAs, and use a platform or managed triage so only about 20% of submissions reach internal teams; expect ~60% noise/false positives. Prefer risk‑based rewards, avoid hard payment promises, and consider paying a split (commonly 50% on triage, 50% on fix). Watch legal exposure (CFAA, sanctions lists) and document dispute terms; small surprises happen (Slack once paid $1,250 for an emoji bug).

AI-written summary · about

" chapters (41)

1. 0:00Introduction
2. 1:00Panel
3. 2:00Introductions
4. 3:00How Many Companies Have Bug Bounty Programs
5. 4:00First Payout for a Hacker
6. 6:00Types of Bug Bounty Programs
7. 7:00Limiting Your Scope
8. 8:00Starting Private
9. 9:00Static Code Analysis
10. 10:00Private Program
11. 12:00Private vs Public
12. 13:00Most Effective Control
13. 14:00Hybrids
14. 15:00Lifecycle
15. 17:00Global vs US
16. 18:00Poorly defined scope
17. 19:00Inhouse counsel
18. 20:00Product development
19. 21:00Legal IR
20. 23:00Vulnerability database
21. 24:00When researchers get paid
22. 26:00Paying upfront
23. 27:00Setting expectations
24. 28:00Signing up for bugs that dont promise to pay
25. 30:00Fixing security vulnerabilities
26. 31:00Consistency
27. 32:00Audience Question
28. 33:00Public vs Private Disclosure
29. 35:00Sharing
30. 36:00False Negatives
31. 37:00Benefits
32. 38:00Legal Risks
33. 39:00False Positive Rates
34. 40:00Transferring Findings
35. 41:00Payment Systems
36. 42:00Payment Frameworks
37. 44:00Ethical Behavior
38. 45:00Ban Everyone
39. 46:00Facebook Bounty
40. 47:00Bitcoin Bounty
41. 50:00Summary

" related talks

• 52mPractical Tips For Running A Successful Bug Bounty ProgramGrant McCracken, Daniel Trauner · AppSecUSA 2016
• 38mManaging for Success: Maintaining a Healthy Bug Bounty Program Long TermChloe Brown · Black Hat USA 2019
• 55mYour License for Bug Hunting SeasonCasey Ellis, Jim Denaro · AppSecUSA 2016
• 51mBug Bounty: Keeping Hacks Ethical in 2022Daniel Garrie, David Cass · RSA Conference 2023
• 11mBuilding a Bug Bounty Program: From the TrenchesYogesh Badwe · RSA Conference 2018
• 15m"You've Got Your Nice List of Bugs, Now What?" Vulnerability Discovery and ManagementSerge Egelman, Primal Wijesekera, Noura Alomar, Edward Qiu · SOUPS 2020
• 43mHard Knock Lessons On Bug BountiesJonathan Cran · OWASP AppSec Research (AppSecEU) 2015
• 46mHow to run a successful bug bounty programmeShadab Siddiqui · Rootconf 2019