How to Win Bugs & Influence Hackers
summary
Explains how a vulnerability disclosure program actually works: set up asset inventories and scheduled vulnerability scans, use standardized vulnerability writeups and a severity table and remediation timelines so bugs get owned and fixed, run a weekly on‑duty triage rotation, start as an invite-only private program (typically start with 4–5 trusted researchers, then +5, +10) before public launch, use safe‑harbor language (eg. Disclose.io) and guidance from Play Academy, and consider Google Play Security Reward integration for paid bounties.
AI-written summary · about
chapters (15)
- 0:00Introduction to VDP
- 1:11Risks of skipping VDP
- 2:14VDP success story
- 4:41Benefits of VDP programs
- 6:25Are you ready for VDP
- 7:48Basics of finding bugs
- 9:12Security review processes
- 11:16Ensuring bug fixes
- 13:01Vulnerability categorization
- 15:28Stakeholder buy-in
- 17:56Creating program policy
- 21:51Launching VDP best practices
- 24:01Private vs public programs
- 25:27Public program launch
- 26:09Google Play Security Reward
related talks
21mApplication Security Response: When Hackers Come A-Knockin
30mDoes Public Disclosure of Vulnerabilities Affect Hacker Participation in Bug Bounty Programs?
42mKeynote: Hacking Policy and Policy Hacking - A Hacker Guide to...
56mHow Building a Better Hacker Accidentally Built a Better Defender
41mWhat the Hack: A Personal Story about Ethical Hacking
12mAre Users Able to Take Control of Their Data?
01mSponsor Interview
15m"You've Got Your Nice List of Bugs, Now What?" Vulnerability Discovery and Management