Jump to content

Open Bug Bounty

Edit links
From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by 5.148.117.68 (talk) at 09:25, 23 February 2018. The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

Open Bug Bounty is a non-profit Bug Bounty platform. The responsible disclosure platform allows independent security researchers to report XSS and similar security vulnerabilities on any website they discover using non-intrusive security testing techniques.[1] The researchers may choose to make the details of the vulnerabilities public in 90 days since vulnerability submission or to communicate them only to the website operators. The program's expectation is that the operators of the affected website will reward the researchers for making their reports.

Program

Unlike commercial bug bounty programs, Open Bug Bounty is a non-profit project and does not require payment by either the researchers or the website operators. Any bounty is a matter of agreement between the researchers and the website operators. Heise.de identified the potential for the website to be a vehicle for blackmailing website operators with the threat of disclosing vulnerabilities if no bounty is paid, but reported that Open Bug Bounty prohibits this.[2]

Open Bug Bounty was launched by private security enthusiasts in 2014, and as of February 2017 had recorded 100,000 vulnerabilities, of which 35,000 had been fixed.[3] It grew out of the website XSSPosed, an archive of cross-site scripting vulnerabilities.[4]

In February 2018, the platform had 100,000 fixed vulnerabilities using coordinated disclosure program based on ISO 29147 guidelines. [5]

References

  1. ^ "Open Bug Bounty: 100,000 fixed vulnerabilities and ISO 29147". Techworm. Retrieved 19 February 2018.
  2. ^ "Open Bug Bounty: Sicherheitslücken gegen Prämie". Heise Security (in German). 12 January 2017. Retrieved 4 January 2018. {{cite news}}: Cite has empty unknown parameter: |dead-url= (help)
  3. ^ "Open Bug Bounty – the alternative crowd security platform for security researchers". TechWorm. 14 February 2017. Retrieved 21 December 2017.
  4. ^ "XSSPosed launches Open Bug Bounty programme for web flaws". SC Media UK. 6 July 2015. Retrieved 21 December 2017.
  5. ^ "Not-for-profit Open Bug Bounty announces 100K fixed vulnerabilities". SC Media. Retrieved 23 February 2018.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Open_Bug_Bounty&oldid=827199038"