How to run a successful bug bounty programme
summary
Shows a concrete result: an automated JIRA workflow that turns incoming reports into tracked tickets, uses post‑functions and groovy scripts to auto‑prioritise (p0/p1/P2), creates a separate payout ticket for finance, and reduces triage to clicking buttons. Claims about effort: roughly 20 days to build the system, plus one‑time automation work. Also spells tradeoffs — commercial platforms take ~20–25% per bounty, while building needs SLAs, monitoring, legal and finance processes, and clear in/out‑of‑scope rules.
AI-written summary · about
chapters (14)
- 0:00Start
- 3:02History
- 3:43Today's Agenda
- 17:42Fix in progress
- 18:38Payout
- 19:31Considerations for a Bug Bounty program
- 22:34Fears/Concerns for a BBP
- 25:37Where to whom does a BB program applies
- 28:34Darkside side of not having one
- 35:10Legal and PR team
- 35:34Logistics issues
- 36:07Why build?
- 38:00To summarise
- 38:13Notes
related talks
48mGamify your Security
11mBuilding a Bug Bounty Program: From the Trenches
52mPractical Tips For Running A Successful Bug Bounty Program
50mBug Bounty Programs: Successfully Controlling Complexity and Perpetual Temptation
38mManaging for Success: Maintaining a Healthy Bug Bounty Program Long Term
45mRunning an efficient bug bounty program and PSIRT... (Garrett McNamara, Jeff Guerra)
37mFrom DevSecOops to Security Success: The Bug Bounty Effect at FINN.no
43mHard Knock Lessons On Bug Bounties