Setting up a bug bounty program for your app
summary
Practical guide for launching a bug bounty: use a triage partner like HackerOne private program to invite trusted researchers first, start very narrow (initially only remote code execution and private data leaks), and require reporters to go to the app owner first so the team can fix before public disclosure. Google Play experiments move from ~50 apps and 0–4 reports/week to 550 apps (>100M installs) and ~20 reports/week, and payouts scale up to $20k (minimum ~$3k) as incentives.
AI-written summary · about
chapters (9)
- 0:00Introduction to bug bounty
- 1:29VDPs vs bug bounties
- 7:09Ideal VDP process
- 10:13Why create a VDP
- 16:35Benefits of structured process
- 23:21Starting a program
- 33:10Adjusting expectations
- 39:08Google Play Security Rewards
- 46:16Q&A
related talks
35mSetting up a bug bounty program for your app
52mPractical Tips For Running A Successful Bug Bounty Program
50mBug Bounty Programs: Successfully Controlling Complexity and Perpetual Temptation
40mDon't Let Bug Bounty Kill Your Appsec Posture
38mManaging for Success: Maintaining a Healthy Bug Bounty Program Long Term
56mRunning a Bug Bounty Program @ SEEK
55mYour License for Bug Hunting Season
41mOverview of common Android app vulnerabilities