Date: May 4, 2021
Our Bug Bounty Community of Interest (BB COI) has been hard at work this year discussing the challenging problems many Bug Bounty programs (BBP) face, potentially including Vulnerability Disclosure Programs (VDP). Throughout our conversations and research, we noticed that there is little comprehensive guidance covering the Bug Bounty space. In an effort to demystify Bug Bounty programs for all audiences, the Bug Bounty Community of Interest is proud to announce our Bug Bounty Framework! Here is what you can expect from us.
Who
The Bug Bounty Framework is meant for those with an established vulnerability disclosure program. We expect readers to have some familiarity with the content covered in FIRST.org’s PSIRT Services Framework. Overall, the Bug Bounty Framework is meant for consumption by a broad audience. If you are starting a program, evaluating your current program, or looking to understand the impacts of Bug Bounties on the rest of the information security community, then you have come to the right place.
What
The Bug Bounty Framework will provide a guide through challenging problems, topics of interest, and ways to assess or establish common Bug Bounty processes. For those new to the Bug Bounty space, we will be discussing strategic and operational foundations such as establishing a charter and determining the type of Bug Bounty Program that is right for you. We will also be discussing best practices regarding researcher support like Safe Harbor, transparency, and terms of service.
For those with established Bug Bounty programs, we will be discussing techniques to ramp up your current program, how to manage mindsets within your organization, or overcoming organizational barriers. We are also focusing on methods for long term support for your Bug Bounty programs.
How
We will be providing a series of blog posts for your consumption. Each blog post will cover common challenges and paths forward that have worked for one or more of our members. Each blog post should be viewed as a “chapter,” which will eventually be consolidated into a complete framework.
When
We will release content periodically, so please be sure to check back for new topics, chapters, and discussions. Our first Chapter, “What is a Bug Bounty Program?” is out now.
Why Us?
We, the contributors, believe that the community learns best by collaboration! The Bug Bounty Community of Interest is composed of a loose group of individuals with deep expertise in vulnerability handling, vulnerability disclosure, and Bug Bounty ecosystems. We are passionate about providing relevant and accurate data for others. Diversity of background and skillset is key, and The BB COI wants our readers to learn from our broad experience (successes and mistakes) when developing or assessing their own Bug Bounty programs.
