This is a work in progress and not a release. We're looking for volunteers. See Issues to know how to collaborate.

Bug Bounties

tag: [Engineer/Developer, Security Specialist]

Bug bounty programs incentivize security researchers to identify and report vulnerabilities in your project. They augments a security team and audits by allowing external security researchers to disclose vulnerabilities in your project in a way that should be a good experience for the security researcher. Depending what the scope of the bug bounty program is, you may have a higher success rate having certain parts at different types of bug bounty as a service providers, as they generally have security researchers with different skill sets using their platforms.

Bug Bounty as a Service

Web3

  • Immunefi
    • Pros: One of the largest bug bounty as a service platforms for web3
  • Hackenproof
    • Pros: Provides end-to-end encryption for reports, ensuring only a project's security team can decrypt it using their own private keys.

Web2

  • HackerOne
  • Bugcrowd

Pros and Cons of Running Your Own Bug Bounty Program

Pros

  1. Full control over the scope, rewards, and rules of the program.
  2. Potentially lower cost.
  3. Direct interaction with security researchers could build strong relationships.

Cons

  1. Requires significant time and resources to manage.
  2. Need for skilled triage abilities to handle and prioritize reports.
  3. Risk of being overwhelmed by reports, including false positives.

Key Elements of a Successful Bug Bounty Program

Scope

  1. Clearly define the scope of the program, including in-scope and out-of-scope assets.
  2. Regularly update the scope to include new features and exclude deprecated ones.

Rewards

  1. Offer competitive rewards based on the severity and impact of the vulnerabilities.
  2. Be transparent about the reward structure and criteria for evaluating reports.

Triage and Response

  1. Have skilled personnel to triage incoming reports, assess severity, and prioritize responses.
  2. Respond to reports promptly, acknowledging receipt and providing regular updates.

Communication

  1. Treat all reporters with respect and professionalism.
  2. Provide feedback to researchers on the status of their reports and any actions taken.
  1. Clearly state safe harbor provisions to protect researchers from legal action when acting in good faith.
  2. Define your policy on public disclosure of vulnerabilities, including timelines and conditions.