Hackers Don't Care About Scope
summary
Claim that tight scopes hide bugs and attackers ignore scope; real findings come from testing DNS zones, dev APIs, exposed Jenkins, third‑party JavaScript and GitHub leaks. Companies with broad programs (Airbnb, Salesforce examples) and one org that expands until everything we own in scope show more high‑impact bugs and infrastructure compromises. Recommend phased rollout—private launch, add asset bundles quarterly using a crawl walk run approach—and treat accidental out‑of‑scope reports leniently, triage and reward when they expose user or network risk.
AI-written summary · about
chapters (14)
- 0:00Introduction to talk
- 0:24Speaker introduction and background
- 1:51Why hackers ignore scope limitations
- 3:57Hidden infrastructure hackers can target
- 5:00Expanding scope for better coverage
- 8:10Hackers’ perspective on scope
- 10:15Success stories with wide scope
- 12:40Missed opportunities with narrow scope
- 13:42Bug bounties vs adversary tactics
- 15:03Phased approach to scope expansion
- 16:46Encouraging out-of-scope reports
- 17:31Feedback from hackers on programs
- 19:17AI’s impact on bug bounty hunting
- 20:00Q&A on scope and security
related talks
44mApplication Security: Everything we know is wrong
38mHackers Gonna Hack: Identifying and Fixing Vulnerabilities Proactively
46mThe Supply Chain Conundrum: Why Traditional Application Security Is...
41mHackers vs. Devs - Attacking Dev Tools and Infrastructure
51mHelpful Hackers
15m"You've Got Your Nice List of Bugs, Now What?" Vulnerability Discovery and Management
58mNothing to Risk but Risk Itself: Expanding Vulnerability Risk with Internet-Scale Data
46mHow to hack a node app?