Loading…
Topic
8 posts about Bug Bounty. Every summary links to the original.
See the idea
An architecture view of a bug bounty program: scope, triage, validation, containment, durable fix, and payout, plus the loop that turns each report into stronger defaults.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
An external researcher, Mehmet Ince, reported a memory-safety flaw in PostGIS’s address_standardizer extension, where caller-controlled grammar data indexed a fixed-size array without bounds checking. Because the extension was available to ordinary tenant roles on managed Postgres services, Databricks treated the issue as a platform exposure rather than a third-party problem, while noting that its microVM architecture meant the exploit did not produce cross-customer impact on Lakebase Postgres and Neon. Detection alerted the Neon team during testing, enabling rapid validation and downstream patching while a durable fix was developed and deployed to protect tenants without customer action. The upstream fix initially missed cases; Mehmet supplied the remaining pieces, and the complete correction was returned to PostGIS, with his bounty donated and matched for the project.
WhatsApp presents an early technical overview of Scam Alert, an optional feature that uses an on-device machine learning model to identify potential scam messages from non-contacts while keeping message content on the device. The warning appears only to the user, who can block, report, continue, or mark a chat trusted; reporting and sharing require explicit user action. To measure performance, the system sends locally aggregated warning and user action counts through confidential federated analytics using Trusted Execution Environments and differential privacy, rather than transmitting raw signals. Model versions are recorded on a public transparency ledger, while published weights, client-side logs, and an expanded Bug Bounty program support independent inspection of delivery and behavior.
Claude Fable 5 has been redeployed globally, accompanied by additional detail about its cybersecurity safety classifiers and a proposed AI jailbreak severity framework. The classifiers distinguish prohibited use, high-risk dual use, low-risk dual use, and benign use, with intended responses ranging from blocking to allowing with monitoring; the model uses a larger safety margin than previous models, accepting more false positives to increase protection against harmful outcomes. Other safeguards include access controls, model safety training, and offline monitoring, while a HackerOne program invites researchers to submit potential cyber jailbreaks. The draft framework measures capability gain against the available baseline and illustrates scoring with Log4Shell cases, where severity changes as discoverability and existing tools change.
Bugbot is replacing its $40-per-seat monthly subscription with usage-based billing for Teams and Individual plans. Existing customers move to the new model at the first billing renewal after June 8, 2026; an annual subscription purchased in May 2026, for example, changes in May 2027, while earlier switching is available in the Cursor dashboard. Teams are billed from on-demand spend, Individuals from included usage, and an average run costs $1.00–$1.50 depending on pull request size and complexity. Usage billing also adds configurable effort levels, including deeper reviews and custom logic for selecting effort: the default retains an 80% bug-resolution rate by merge time, while high effort finds 35% more bugs in internal runs with that rate unchanged.
Grab marks the tenth anniversary of its bug bounty program, launched with HackerOne and initially involving 23 researchers. Over the decade, it grew into a global community, partnering with more than 850 active HackerOne researchers to help protect over 187 million users across Southeast Asia. The program broadened its scope in 2023–2024, adding assets that included Indonesian financial services and AI systems, while introducing a mobile-specific bounty table and experimenting with campaigns and reward methods. Grab says it now ranks among HackerOne’s top 20 programs worldwide and top three in Asia, and credits live hacking events and regional club campaigns with expanding testing coverage and researcher relationships. Anniversary activities included invite-only campaigns in Germany, Morocco, and India, plus a broader campaign that received 461 submissions, with xchopath receiving the Best Hacker Bonus.
Shopify announces that it has awarded more than $1M USD through its bug bounty programs, which complement its security strategy by bringing in researchers with varied perspectives to assess the platform. The company says it is the fifth public program among 176 on HackerOne to reach that milestone, after four years of working with researchers. It describes three resolved vulnerabilities: an SSRF in Shopify Exchange that could provide root access within one infrastructure subset, an admin authentication bypass involving duplicate partner accounts, and stored cross-site scripting from improperly sanitized sales-channel SVG files. Shopify disabled or audited affected services, deployed a metadata-concealment proxy, corrected account verification, removed unnecessary admin functionality, and checked for exploitation. It plans to experiment with ways to increase hacker engagement and make the program more attractive.
Heroku frames security as an engineering discipline that must challenge happy-path assumptions, test continuously, and prepare for low-predictability, high-consequence “black swan” events. Its threat-modeling guidance focuses on challenging defaults, recognizing that attackers have resources and organizational support, and planning for unexpected failures such as a zero-day exploit. A control-plane instrument for Heroku Postgres detected privilege escalation to a superuser role, and the Data team isolated the instance within 17 minutes while investigating the activity. The event was traced to researcher Andrew Krasichkov (“buglloc”), whose testing exposed a vulnerability in the dblink and postgres_fdw extensions. Through the Bugcrowd bug bounty program, Heroku worked with him to understand the issue, reward the finding, and defend against the previously unknown flaw before a patch was available.
Shopify’s 2017 bug bounty review reports higher payouts, four-hour average first responses, four-day triage, and changes intended to improve researcher participation. The program paid $67,550 outside the H1-415 event, with an average bounty of almost $1,100, while 121 reports were resolved and 63.1% of submissions were closed as not applicable. At H1-415, five hackers helped resolve 15 bugs for $42,000, and the program’s largest individual payout, $20,000, addressed unauthorized collaborator access caused by account-conversion logic. Shopify also acknowledges fewer resolved reports and delayed low-severity cases, then announces a $500 minimum payment at triage, clearer scope and payout guidance, a $25,000 typical maximum, and earlier access to beta functionality for eligible whitehat partner accounts.
The best engineering reads, once a week.
