Running a Bug Bounty Program @ SEEK

on YouTube ↗56m

" summary

SEEK runs a two‑week, production bug bounty POC via Bugcrowd with 50 researchers invited and a $15k USD pool, yielding 104 reports, 3 high severity findings and about 15 active submitters; typical rewards cluster around $200 while top payouts reach ~$2k. Testers uncover real issues: XML external entity exfiltration, password‑reset enumeration, and a chained Twitter SSO → support → Slack disclosure. Production testing holds up with no major outages and leads to an ongoing program.

AI-written summary · about

" chapters (12)

1. 0:00Start
2. 2:40Bug Bounty Programs
3. 7:52The Dark Web
4. 15:28Can We Make Our Web Apps 100 % Secure
5. 16:28Car Safety Analogy
6. 16:51The Red Cross Breach
7. 18:12Conjoined Triangles of Success
8. 23:11Benefits of a Private Program
9. 26:11Can I Run a Bug Bounty Program
10. 26:48What Is the Maturity of Your Website
11. 31:07Risk Mitigations
12. 46:17Xml Entity Attack

" related talks

• 52mPractical Tips For Running A Successful Bug Bounty ProgramGrant McCracken, Daniel Trauner · AppSecUSA 2016
• 43mHard Knock Lessons On Bug BountiesJonathan Cran · OWASP AppSec Research (AppSecEU) 2015
• 35mSetting up a bug bounty program for your appSebastian Porst · droidCon Berlin 2019
• 55mYour License for Bug Hunting SeasonCasey Ellis, Jim Denaro · AppSecUSA 2016
• 50mBug Bounty Programs: Successfully Controlling Complexity and Perpetual TemptationCassio Goldschmidt, Michael Gallagher, Sean Martin, Sean Melia, Michael Stoker · AppSec USA 2017
• 11mBuilding a Bug Bounty Program: From the TrenchesYogesh Badwe · RSA Conference 2018
• 40mDon't Let Bug Bounty Kill Your Appsec PostureZohar Shchar · Global AppSec Dublin 2023
• 37mFrom DevSecOops to Security Success: The Bug Bounty Effect at FINN.noEmil Vaagland · NDC Security 2025