But, how does that happen? What is it? Why do organizations have them? Here, we shall discuss it, along with a list of bug bounty platforms built by some of the world’s biggest tech companies.
What Is a Bug Bounty Program?
A bug bounty program rewards independent researchers and ethical hackers when they find a bug or a security vulnerability in a service/website. A bug bounty program is a perfect place for security researchers or hackers to put their skills to the test. It gives the feel of a public competition and a run for the money with your skills. As per your activities, it could end up being a full-time job for you. And, for some, it can be a rewarding side gig. Generally, these platforms offer huge prize money if you report a severe problem in their service. It is also important to note that there are two different bug bounty platforms. Some companies prefer to build their platform, while others use existing third-party bug bounty platforms to add objectives/tasks for the mentioned reward. However, some do have a set of minimum requirements for a report to qualify. So, not every bug you report will earn you rewards. It would help if you went through the rules or guidelines of a bug bounty program before deciding to invest time in it.
Why Do Organizations Have Bug Bounty Platforms?
Now you know that a bug bounty program lets any organization involve independent security researchers (or professionals they do not directly employ) to find bugs and vulnerabilities in their product/website. But why is a bug bounty program necessary for big companies? Don’t they already have skilled employees who constantly improve the service? Technically, yes. But, the aim of creating a bug bounty platform is to have more security researchers audit or test their service (for free). Exactly. The entire community of ethical hackers and researchers tests their services and gives them feedback through reports. They do not have to pay an upfront fee for their work. The company only pays a reward (often lucrative) when an individual submits a valid bug or security report. Overall, a bug bounty program is profitable for companies to improve their product, and it is equally rewarding for ethical hackers and researchers. So, it is a win-win scenario.
Biggest Bug Bounty Programs
There are countless bug bounty programs across the globe. Here, we stick to some of the most prominent programs available. Note that every program has different rules for eligibility and rewards. Some offer rewards and recognition for software-based issues, and some for hardware. So, make sure to check the eligibility criteria, qualifying report rules, and the type of vulnerabilities eligible for the prize.
Apple Security Bounty
Apple Security Bounty is one of the biggest platforms for ethical hackers. It offers rewards up to $1,000,000 (a million dollars) for various security issues on iCloud and its smartphones. Not just limited to the reward prize, but getting involved with Apple while having a successful report should give you good public recognition for your work. They also match the bounty payments to a few qualifying charities, which is good.
Meta Bug Bounty
Meta, formerly Facebook, also has its bug bounty program, a.k.a Whitehat. The reward money can go up to $45,000. As per the bug’s severity, the prize money can be a lot more (or a lot less). Meta posts the name of all the security researchers publicly to thank them. You can find credits to researchers since 2011 and prior. In addition to that, they also offer a loyalty program that helps you multiply your rewards (up to 20%) and earn sponsored travel/trips to hacker events by Meta.
Bug Hunters by Google
Bug Hunters bounty program lets you report issues across multiple domains/services by Google (YouTube, Blogger, etc.) The rewards can go up to $30,000 and more for special reports. They also feature a learning platform where you can take inspirations/targets from existing examples and learn as you go.
Microsoft Bug Bounty
Microsoft bug bounty program provides ample opportunities to contribute and get recognized for your work. The rewards can go up to $1M or more as per the severity and the type of report.
Mozilla Security Bug Bounty
Mozilla’s security program is an exciting platform for researchers. While they do not publicly disclose the prize money expectations, you get your name in a hall of fame listing.
Unlike others, Twitter utilizes a third-party bug bounty platform to let researchers join. The minimum bounty starts at $280 and can go up to $20,000. It also includes a hall of fame on the HackerOne platform to thank the eligible researchers.
Uber
Uber’s bug bounty program also relies on HackerOne, where you can get up to $15,000 for critical reports and get your name on the hall of fame.
Tesla
Tesla’s bug bounty program can be found on Bugcrowd, yet another third-party bug bounty platform. The rewards can range up to $15,000 per vulnerability as per the eligibility criteria.
Intel Bug Bounty
Intel’s bug bounty program can be found listed in the initigriti platform. It is a rewarding opportunity for researchers to find software, firmware, and Intel hardware issues. The rewards can go up to $100,000.
Tencent Security Response Center
Tencent’s bug bounty program covers various assets like WeChat, QQ, Tencent’s website, domains, and several other applications owned by them. The rewards may not be the highest, ranging up to $3800 for the essential disclosures; you do get a hall of fame board.
Samsung Rewards Program
Samsung Rewards Program is the bug bounty program for Samsung’s mobile products. Considering your report qualifies, the reward can go up to $2,00,000 and more as per the severity of the issue. While you can report it using its official website, they rely on Bugcrowd to process the payments and contact the researcher.
Cisco Meraki
Cisco’s product/offering that deals with enterprise-focused cloud-controlled WiFi, routing, and security utilizes Bugcrowd for its bug bounty program. Considering it as a specialized offering, the work/skills needed to uncover issues can be challenging or exciting. The rewards can go up to $10,000 for severe issues.
Netflix Bug Bounty
Netflix’s bug bounty program can also be found on Bugcrowd, where they list all their domain/services that are eligible for testing/reports. The rewards can go up to $20,000 per vulnerability.
PayPal
Paypal’s bug bounty program utilizes the HackerOne platform. Also, it needs two-factor authentication enabled to be able to participate. The rewards can go up to $20,000 for critical vulnerability reports.
Intuit Bug Bounty
Intuit, the company behind products like QuickBooks, TurboTax, Mint, etc., offers the ability to submit a report using a form on its official website and also HackerOne. With HackerOne, the bug bounty program is private. So, you will have to log in to your account to verify and participate.
Shopify
Being one of the most popular eCommerce platforms, Shopify’s bug bounty program on HackerOne can pay up to $50,000 reward for a severe vulnerability.
Alibaba
Alibaba’s BugBounty Program covers most of the website/services it owns. You can submit the vulnerability report from its official website and expect rewards up to $2500.
Soundcloud
One of the largest open audio platforms, Soundcloud offers a Bugcrowd-based bug bounty program with rewards of up to $4500 in case of severe vulnerability reports. You will get the usual hall of fame with bugcrowd.
Airbnb
Airbnb offers rewards of up to $15,000 through the HackerOne bug bounty platform. It also holds promotions to encourage hackers to work on new critical vulnerabilities while offering a 50% bonus.
Booking.com
Booking.com does not disclose any particular details (except the eligible domains) on HackerOne. You can contact their security team through HackerOne’s disclosure assistance program.
Xiaomi
Xiaomi utilizes HackerOne for its bug bounty program. The program covers several services for researchers and includes special rewards and bonuses on top of up to $8000 prize reward for a critical vulnerability in their business products.
Square
Square is a point of sale application available for smartphones. For any severe vulnerability reports for its app/website, it offers up to $5000 as a reward through its bug bounty program on Bugcrowd.
Nintendo
Nintendo’s bug bounty program lets you find issues that let players cheat, pirate the games, and other technical problems. The rewards can go up to $12,000.
Coinbase
Coinbase is a dominant cryptocurrency exchange platform. It offers a bug bounty program through HackerOne offering rewards up to $50,000.
Cloudflare
Cloudflare offers most of the important services that help internet companies protect and improve their offerings on the web. Its bug bounty program on HackerOne describes various issues that a researcher can look for, along with links to all the necessary documentation. The rewards can go up to $3000 for severe issues.
ExpressVPN
ExpressVPN’s bug bounty program is arguably the biggest among other VPN service providers. Along with the usual rewards of up to $2500, it also provides a one-time bonus of up to $1,00,000 if you’re the first to report a remote code execution vulnerability or something that leaks the IP addresses of clients.
The Hunt for Bugs, Rewards, and Recognition
Considering that a bug bounty program gives ethical hackers a playground to test their skills, it sounds like a good idea for any independent researcher and the company to improve their offerings. It is incredibly important to follow the rules/guidelines mentioned in the bug bounty program. If you fail to meet the criteria, you will waste time, and your report won’t qualify for a reward. You may also be interested in Ethical hacker training grounds.
