Any Update? Lessons Learned From Running a Bug Bounty Program for Over 5 Years

" summary

Describes Shopify’s experience running a public HackerOne bug bounty program for over five years, including metrics (489 resolved reports from 301 hackers) and the effect of offering one of the platform’s highest minimum bounties. Covers operational challenges such as handling increased volume and invalid reports, onboarding and mentoring less-experienced hackers, meeting HackerOne SLA response requirements, and how proactive public disclosure of reports and relationship-building with top hackers fit into the company’s overall security strategy.

AI-written summary · about

" related talks

• 38mManaging for Success: Maintaining a Healthy Bug Bounty Program Long TermChloe Brown · Black Hat USA 2019
• 11mBuilding a Bug Bounty Program: From the TrenchesYogesh Badwe · RSA Conference 2018
• 52mPractical Tips For Running A Successful Bug Bounty ProgramGrant McCracken, Daniel Trauner · AppSecUSA 2016
• 04mAnother year of HackerOne statisticsRoeland Douma · Nextcloud Conference 2018
• 45m2014.10.29 - Security@Scale - Katie Moussoris, HackerOneKatie Moussoris · Security @Scale 2014
• 46mHow to run a successful bug bounty programmeShadab Siddiqui · Rootconf 2019
• 30mDoes Public Disclosure of Vulnerabilities Affect Hacker Participation in Bug Bounty Programs?Ali Ahmed, Amit Deokar, Brian Lee · Black Hat USA 2023
• 26mLife of a Bug (an insight on the GitHub bounty...Caitlin Buckshaw, Jeffrey Guerra · BSidesSF 2023