4 ms·
In my opinion and experience, if you decide to communicate with the individual, ask them to create an account on HackerOne [1]. You should do so as well. Even
by LinuxBender 8y ago
In my opinion and experience, if you decide to communicate with the individual, ask them to create an account on HackerOne [1]. You should do so as well. Even if the pay-out for your bugs was really small, at least you have given the person an opportunity to register a payment method that can potentially link back to them. You would have also given them and others a well defined process to report the bug.
[1] - https://www.hackerone.com/ https://www.hackerone.com/
On a side note, look through all of your access logs leading up to the communication. That can give you an idea of what bots and security tools were enumerating. Then dig deeper into each script they hit with your security team, or hire someone to analyze your code. Also, try to export dumps of your databases and look for things that should not be there. i.e. entries by unauthenticated services or users.
- jamieweb 8y agoIs it possible to give a bounty to a user on HackerOne even if you don't run a bounty program? I thought that the only way to pay them was if they submit a report to your own program. Obviously this is a problem is you don't have a program.
- LinuxBender 8y agoYou would create your bounty program through them. The hackers would register with HackerOne and follow their process. In my opinion, that is much safer than creating your own program if you don't already have a modest sized legal, compliance and security teams.
- jamieweb 8y agoRight yeah that's what I was thinking. The problem is that the process of creating a HackerOne bounty program can take a short while to get to the stage where you can invite hackers - if you have an active hacker on the line like OP does, that could be too long of a wait.
- LinuxBender 8y agoAdvise them you are looking into creating your bug bounty program and kindly ask them to wait while you get things set up.