Setting up a bug bounty program for your app

on YouTube ↗35m

" summary

Overview of a practical bug bounty: Google Play’s program runs on HackerOne, covers 40 partner apps and pays roughly $1k–$3k per bug, with almost $200k disbursed so far. It restricts scope to three classes — remote code execution, PII leaks, and protected component access — and started private to vet policies and hunters. Expect ~2 valid reports/week for 40 apps, require an internal triage owner, 24‑hour acknowledgements, and a 90‑day disclosure norm.

AI-written summary · about

" chapters (7)

1. 0:00Introduction to bug bounty programs
2. 4:17Why create a bug bounty program
3. 12:52How to set up a disclosure program
4. 20:30Starting a bounty program step-by-step
5. 27:34Managing and scaling your program
6. 30:03Google Play Security Rewards Program
7. 34:03Q&A and next steps

" related talks

• 46mSetting up a bug bounty program for your appSebastian Porst · droidcon NYC 2019
• 56mRunning a Bug Bounty Program @ SEEKJulian Berton · NDC Sydney 2017
• 40mDon't Let Bug Bounty Kill Your Appsec PostureZohar Shchar · Global AppSec Dublin 2023
• 43mHard Knock Lessons On Bug BountiesJonathan Cran · OWASP AppSec Research (AppSecEU) 2015
• 52mPractical Tips For Running A Successful Bug Bounty ProgramGrant McCracken, Daniel Trauner · AppSecUSA 2016
• 55mYour License for Bug Hunting SeasonCasey Ellis, Jim Denaro · AppSecUSA 2016
• 50mBug Bounty Programs: Successfully Controlling Complexity and Perpetual TemptationCassio Goldschmidt, Michael Gallagher, Sean Martin, Sean Melia, Michael Stoker · AppSec USA 2017
• 11mBuilding a Bug Bounty Program: From the TrenchesYogesh Badwe · RSA Conference 2018