I work for a B2B SaaS startup that doesn't have a lot of money (we're 6 people, 2 developers, have about 6 months of runway, and $25K monthly revenue, < 50 customers).

Common advice that I've seen for small companies/startups is to "do enough" for security (a balance of risk/reward). For us, however, it's at the forefront of our thinking when we're writing code (e.g. we include a security review as an explicit step in our code merge review process, we only use prepared SQL statements, etc.).

Recently a security researcher contacted us about a few vulnerabilities. I told them we don't have an official bounty program, but we're willing to compensate. I said that Slack's program could be a guide of how we could pay (it really depends on the issue and the impact/risk to our business).

The first reported issue was a CSRF attack that could allow a victim to accidentally add the attacker to their account and get full admin access to the victim's account. This was POC since it needs a little bit of work to exploit. We believed that if exploited, it could expose all users of our user's data. Even though it was POC, it could potentially destroy our business. We rewarded them $500 as well as mailed some swag. When we went to pay them, they requested $550 because of PayPal fees. I told them that if we were listed on a site like HackerOne, PayPal still takes out fees regardless of the amount.

They reported an issue for an IDOR attack that could allow any authenticated attacker to "disable" any user in our application. Disabling a user in our application just sets a flag that they can't log in. This attack doesn't disclose any information, and is easily reversible. Right now, we believe that the actual business impact/risk is very low (since it can be reversed and doesn't expose customer data). We fixed this vulnerability immediately. The security researcher was very pushy with their expected reward in their initial report. They quoted $15000 for an IDOR attack on Uber, and $1500 from Slack. I responded and said we're going to internally discuss the reward because we feel the impact is low. They sent a response saying how critical this issue is and how it can cause havoc on our business. English isn't this person's first language (and the reports are dramatic/low quality in terms of communication), but I've cut through that and only focused on the business impact (not the report/reporter).

We want to encourage vulnerability reports and we want to reward/compensate reporters with market rates. However, we don't have a lot of money since we're a startup without any investment. I'm having a large internal struggle of compensating for vulnerabilities vs being out of jobs because our money is going to payouts for vulnerabilities. We don't want to pay nothing, but we want to encourage white hat reports.

Right now, I'm in the mindset of "pay what we feel it's worth for risk/impact of the business". For the second vulnerability, we discussed to be worth $150. When we sent a response with our amount, they've tried to haggle us to $500, and $300 claiming it's unfair.

What advice would you give a small company for creating/maintaining a bug bounty program?

  • 1
    The pushy behaviour is sounding more like racketeering to be honest. I would set in your terms and conditions what your policy is on vulnerability disclosure. In there you should cap a maximum you are willing to pay out on any. If the pen tester then preceeds to demand money that is over this limit you can indeed claim they broke your terms and conditions of use and potentially commited an illegal act. Don't get me wrong I think disclosing vulnerabilities to companies is a great thing, but there has to be some control on this. – ISMSDEV Jul 10 '17 at 15:43
  • 1
    @ISMSDEV We considered it racketeering too... it feels very hostile right now. We've stayed firm with paying $150. We never had a policy about a vulnerability disclosure program (but it's something we're looking to add now). I'm all for setting up the rules for a program... but it's sort of weird because we don't have official rules in place. The good news is that we have this person's full name, mobile number, and address... so if they go rogue we can try to report them. But, emotionally it's still very uneasy for me. I've never had to deal with something like this. – Startup Security Jul 10 '17 at 15:49
  • 3
    Not sure why this question got a close vote as off-topic. Rather, it seems to be the first time the [bug-bounty] tag is actually used correctly. – Arminius Jul 10 '17 at 17:29
  • 3
    @StartupSecurity SecuritySE is pretty sensitive about questions that seem like they can't be answered definitively. I personally like the question. Maybe instead of asking about "how should a startup...", you could rephrase it along the lines of "what are possible/established ways to...", "how do others solve this", "what are advantages and disadvantages of...", etc. Not sure if that will be successful, though. You might want to raise the issue on meta, too. – Arminius Jul 10 '17 at 19:47
  • 2
    You consider 'loss of all user data' very valuable, and 'accounts being disabled' as much less valuable, but looking around at response to real world incidents it feels like "I can't login / the service doesn't work" is an enormous problem for people and makes people leave services, but "my data was leaked" is effectively a non-issue, and they probably won't ever even find out it happened. "we feel the impact is low" - realistically, which one will cause more support calls? More complaints? All your users can't login, or you send a 'newsletter' about a breach .. which they don't read? – TessellatingHeckler Jul 10 '17 at 19:47

It may not help with your current situation, but consider registering with someone like bugcrowd and posting your reward range. If someone contacts you asking for something over and above your posted range, politely redirect them to your bounty page and let them know that's all you can afford.

Legitimate researchers will look at your site and decide whether or not your rewards are worth their time. Smaller rewards may mean less experienced testers will gravitate towards your site; but this way nobody will be surprised.

  • This is what we had planned to do, and now are definitely going to do. – Startup Security Jul 10 '17 at 19:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.