What are some options for a small company on a budget to maintain a bug bounty program? [closed]

Question

I work for a B2B SaaS startup that doesn't have a lot of money (we're 6 people, 2 developers, have about 6 months of runway, and $25K monthly revenue, < 50 customers).

Common advice that I've seen for small companies/startups is to "do enough" for security (a balance of risk/reward). For us, however, it's at the forefront of our thinking when we're writing code (e.g. we include a security review as an explicit step in our code merge review process, we only use prepared SQL statements, etc.).

Recently a security researcher contacted us about a few vulnerabilities. I told them we don't have an official bounty program, but we're willing to compensate. I said that Slack's program could be a guide of how we could pay (it really depends on the issue and the impact/risk to our business).

The first reported issue was a CSRF attack that could allow a victim to accidentally add the attacker to their account and get full admin access to the victim's account. This was POC since it needs a little bit of work to exploit. We believed that if exploited, it could expose all users of our user's data. Even though it was POC, it could potentially destroy our business. We rewarded them $500 as well as mailed some swag. When we went to pay them, they requested $550 because of PayPal fees. I told them that if we were listed on a site like HackerOne, PayPal still takes out fees regardless of the amount.

They reported an issue for an IDOR attack that could allow any authenticated attacker to "disable" any user in our application. Disabling a user in our application just sets a flag that they can't log in. This attack doesn't disclose any information, and is easily reversible. Right now, we believe that the actual business impact/risk is very low (since it can be reversed and doesn't expose customer data). We fixed this vulnerability immediately. The security researcher was very pushy with their expected reward in their initial report. They quoted $15000 for an IDOR attack on Uber, and $1500 from Slack. I responded and said we're going to internally discuss the reward because we feel the impact is low. They sent a response saying how critical this issue is and how it can cause havoc on our business. English isn't this person's first language (and the reports are dramatic/low quality in terms of communication), but I've cut through that and only focused on the business impact (not the report/reporter).

We want to encourage vulnerability reports and we want to reward/compensate reporters with market rates. However, we don't have a lot of money since we're a startup without any investment. I'm having a large internal struggle of compensating for vulnerabilities vs being out of jobs because our money is going to payouts for vulnerabilities. We don't want to pay nothing, but we want to encourage white hat reports.

Right now, I'm in the mindset of "pay what we feel it's worth for risk/impact of the business". For the second vulnerability, we discussed to be worth $150. When we sent a response with our amount, they've tried to haggle us to $500, and $300 claiming it's unfair.

What advice would you give a small company for creating/maintaining a bug bounty program?

Answer 1

It may not help with your current situation, but consider registering with someone like bugcrowd and posting your reward range. If someone contacts you asking for something over and above your posted range, politely redirect them to your bounty page and let them know that's all you can afford.

Legitimate researchers will look at your site and decide whether or not your rewards are worth their time. Smaller rewards may mean less experienced testers will gravitate towards your site; but this way nobody will be surprised.