4 ms·
Is it possible to give a bounty to a user on HackerOne even if you don't run a bounty program? I thought that the only way to pay them was if they submit a repo
by jamieweb 8y ago
Is it possible to give a bounty to a user on HackerOne even if you don't run a bounty program? I thought that the only way to pay them was if they submit a report to your own program. Obviously this is a problem is you don't have a program.
- LinuxBender 8y agoYou would create your bounty program through them. The hackers would register with HackerOne and follow their process. In my opinion, that is much safer than creating your own program if you don't already have a modest sized legal, compliance and security teams.
- jamieweb 8y agoRight yeah that's what I was thinking. The problem is that the process of creating a HackerOne bounty program can take a short while to get to the stage where you can invite hackers - if you have an active hacker on the line like OP does, that could be too long of a wait.
- LinuxBender 8y agoAdvise them you are looking into creating your bug bounty program and kindly ask them to wait while you get things set up.