Practices
Bug Bounty
A bug bounty program invites independent security researchers to find and responsibly disclose vulnerabilities in exchange for rewards. Bounties tap a large, diverse pool of testers and run continuously, but results depend on researcher interest and coverage can be uneven across an application.
Key points
- Crowdsourced, continuous, pay-for-results testing.
- Coverage varies with researcher interest.
- Complements structured testing and autonomous coverage.
Related
Impactr finds and proves whether flaws like this are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.