SEARCH
Archive
Lawyers, Bugs, and Money: When Bug Bounties Went Boom
Bug bounties have grown from a niche idea to encourage independent security research into a massive business and a legitimate career path for bug hunters in less than 15 years. This is the story of the hackers who made that happen.
CISA Issues Final Order on Federal Vulnerability Disclosure, But Questions Remain
Federal agencies must publish a vulnerability disclosure policy by March 1, per a new CISA directive, but there is no provision for maturity assessments or resources to build a bug handling process.
Time, Not Money, Kills Bugs
The measure of a bug bounty program's success is not how much researchers were paid, but how the organization handled the volume of new reports. GitLab's James Ritchey share some of the lessons learned in the company's first year of the public bug bounty program.
Taking Hype Out of Bug Bounty Programs
“Bug bounty apostate” and Luta Security founder Katie Moussouris said bug bounty programs have veered away from their original mission: help organizations become more secure.
Open Source Software Needs Funding, Not Bug Bounty Programs
Bug bounty programs fill a need, but the European Union's offer to pay bug bounties for vulnerabilities in open source forgets one thing: projects don't need more flaws. Open source projects need people to fix the flaws.