We run a private bug bounty (not via H1 but another platform), classical pentests, dynamic code assessment and a responsible disclosure program. Pentests are o

We run a private bug bounty (not via H1 but another platform), classical pentests, dynamic code assessment and a responsible disclosure program. Pentests are ok, they help to scrap plenty of bugs. I am not a great fan otherwise because it is based on a fixed rate. Private bb ended up fantastic. Great bugs, great researchers, reasonably good pay (not Apple grade but we paid some 30k€ irrc). Feedback from researchers was good, including unexpected public praise. Dynamic code reviews are a mixed bag. Usually crap, sometimes hidden gems. Responsible disclosure is a mixed bag too. It is very binary : 20% great from great researchers we usually invite to the private bounty afterwards, and 80% garbage. Oh man, the garbage. Often I do not even understand the submission (not being a native English speaker either). One other problem with public programs are legal implications to pay an anonymous reporter (imagine a US company paying someone affiliated with NC or Iran or Daesh, and that info published in the press)