Data Driven Bug Bounty
summary
Collects JIRA-tagged metrics, feeds them into SuperSet dashboards, and ties HackerOne/Bugcrowd and NCC Group triage data to prioritization. Shows concrete numbers: ~\$1M paid over four years with 850 resolved reports at Twitter, \$430k and 430 reports at Airbnb, about 50% of intake from HackerOne. Tracks time to response, average time to fix, SLA breaches by team and vulnerability classes, uses those graphs to cut XSS and sensitive data exposures and drive a team from many past‑SLA bugs to sustained zero.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 0:46Agenda
- 1:29Program Logistics
- 4:24DataDriven Program
- 9:32Time to Fix
- 11:58Subteams
- 17:35Vulnerability Sources
- 20:26Metrics
- 23:37Methodology
- 26:55QA
related talks
26mLife of a Bug (an insight on the GitHub bounty...
04mAnother year of HackerOne statistics
43mHard Knock Lessons On Bug Bounties
46mHow to run a successful bug bounty programme
45m2014.10.29 - Security@Scale - Katie Moussoris, HackerOne
12mAre Users Able to Take Control of Their Data?
48mGamify your Security
44m10 years of Working with the Community