Discover and read the best of Twitter Threads about #bugbounties
Most recents (1)
Excellent post re hunting #bugbounties . These stats show the researcher's persistence & skilling up, & also inadvertently highlights problems w the #bugbounty ecosystem. What other security job only pays for 57% of your work?
"13% reward rate for 1st month, then 25%, then 57%."
"13% reward rate for 1st month, then 25%, then 57%."
I'm a fan of creating incentives. What #bugbounties have turned into is a misinformed (on both hunted & hunter sides) replacement for other security activities. Thoughtful incentives (including but not limited to bounties) creates win-win. The 1st MS bounties had no duplicates.
I love that bug hunters & orgs running bug bounties are using the programs to learn. That's great news. But is it improving security over time, or just outsourcing QA, encouraging sloppier releases & deployments, which lead to more low-hanging fruit, & therefore more duplicates?
