Loading post…
GrabGrab EngineeringAnnouncement
Come and #hackallthethings at Grab
Summary
Grab has officially launched a public bug bounty program in partnership with HackerOne to strengthen the security of its platform. This rollout follows a private bounty initiative operated over the previous year, during which the organization worked with over 350 security researchers and resolved nearly 200 awarded bug reports. The new public program invites external researchers to scrutinize Grab's code for critical flaws, including remote code execution, SQL injections, and exportable cross-site scripting vulnerabilities. To support ethical and responsible disclosure, Grab offers payouts reaching up to $10,000 per valid vulnerability report based on severity and impact.
Context
Grab seeks to ensure that the data of millions of driving partners and consumers remains secure and to protect users through transparent, ethical security practices.
Approach / What changed
Grab launched an official public bug bounty program in partnership with HackerOne, offering monetary rewards for identified and responsibly disclosed vulnerabilities.
Takeaways
Grab ran a private bug bounty program for one year, working with more than 350 researchers and awarding nearly 200 bug reports.
The public bug bounty program invites researchers to identify high-impact issues including remote code execution, SQL injections, and exportable XSS vulnerabilities.
Valid bug reports submitted through HackerOne are eligible for rewards of up to $10,000 depending on impact and severity.
Source and freshness
- Source
- engineering.grab.com
- Published
- Added to Yomu
- Last updated
Summaries are generated from the original by a language model. Check the original before relying on it.
Keep reading
Related reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.