Reflecting on the Five Years of Bug Bounty at Grab

Summary

Grab launched a private bug bounty programme on HackerOne before opening it publicly in 2017 to complement internal product security efforts. Prior to going public, the team conducted security sweeps, established policies, and expanded the testing scope to prepare for an influx of reports. Operationally, the team opted to pay full bounties immediately upon report triage rather than waiting for vulnerability resolution to incentivize security researchers. Noise reduction was handled using HackerOne Triage, Human-Augmented Signal, and by blocking automated scanning networks targeting Grab's infrastructure. In addition, rotating security engineers weekly and integrating HackerOne APIs with PagerDuty ensured fast initial response times.

Takeaways

1. 1

   Grab pays the full bounty payout immediately after a report is triaged rather than waiting for vulnerability remediation.

2. 2

   A dedicated security engineer is assigned each week during sprint planning to focus exclusively on reviewing and responding to bug bounty reports via PagerDuty and HackerOne API alerts.

3. 3

   Mobile app testing engagement faced obstacles including anti-fraud account blocks, manual verification gates for driver accounts, and geographical restrictions for researchers outside Southeast Asia.