Questions tagged [bug-bounty]

Related to design, workings and operation of bug bounty programs. DO NOT use for questions about specific vulnerabilities, attack methods or anything unrelated to the mechanics of vulnerability reward programs.

Filter by
Sorted by
Tagged with
7 votes
2 answers

Why do several bug bounties ignore user enumeration?

While viewing bug bounties, I noticed that most of the bug bounties list the user enumeration in the excluding list. For instance brute forcing user accounts, forget password forms would generally ...
1 vote
1 answer

Worst-case scenario OPEN URL REDIRECTION and why google not covering it in bug bounty

OPEN URL REDIRECTION as per in my opinion can be proved very dangerous by crafting attacks such as phishing. But it seems like google thinks it as a very low level bug and does not provide any ...
  • 105
9 votes
3 answers

How to work effectively to win bug-bounties?

I really want to prove myself (to my parents) by winning a proper bug bounty How should I best prepare for this and go about actually finding bugs? Edit So can anyone give some web sites which ...
  • 199
-5 votes
4 answers

Should companies use crowd source audit platforms for penetration tests? [closed]

As a CIO, CISO, CTO or Sys Admin, would you use a crowdsourced platform for penetration tests in order to improve your security issues? Google, Facebook, PayPal and other big companies have a Bug ...
17 votes
3 answers

Which companies facilitate payment in return for vulnerability disclosure?

If requesting payment from an affected party directly for the disclosure of vulnerabilities is considered extortion, how can independent security researchers earn a living or side income from ...
  • 423