GrabPei Shan YapAnnouncement
Grab marks the tenth anniversary of its bug bounty program, launched with HackerOne and initially involving 23 researchers. Over the decade, it grew into a global community, partnering with more than 850 active HackerOne researchers to help protect over 187 million users across Southeast Asia. The program broadened its scope in 2023–2024, adding assets that included Indonesian financial services and AI systems, while introducing a mobile-specific bounty table and experimenting with campaigns and reward methods. Grab says it now ranks among HackerOne’s top 20 programs worldwide and top three in Asia, and credits live hacking events and regional club campaigns with expanding testing coverage and researcher relationships. Anniversary activities included invite-only campaigns in Germany, Morocco, and India, plus a broader campaign that received 461 submissions, with xchopath receiving the Best Hacker Bonus.
Grab is marking ten years of collaboration through its bug bounty program and describes the initiative as a way to adapt to a dynamic threat landscape, expand security testing, and build relationships with researchers across regions.
The program expanded its asset scope, introduced mobile-specific rewards, experimented with campaigns and recognition, participated in live hacking events, and ran anniversary campaigns with HackerOne clubs in Germany, Morocco, and India.
The program grew from 23 initial researchers to more than 850 active HackerOne researchers over ten years.
Scope expansion in 2023–2024 included financial services in Indonesia and AI systems, alongside a dedicated mobile vulnerability bounty table.
A broader anniversary campaign generated 461 submissions, while live events and regional club campaigns expanded global security testing coverage.
Summaries are generated from the original by a language model. Check the original before relying on it.
See the idea
An architecture view of a bug bounty program: scope, triage, validation, containment, durable fix, and payout, plus the loop that turns each report into stronger defaults.
Keep reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
One useful email. Unsubscribe anytime.
