> "I've seen some quote unquote valid vulnerability reports," Laurens ("lvh") Van Houtven, principal at Latacora, a secops and cryptography expert, tells CSO. "

> "I've seen some quote unquote valid vulnerability reports," Laurens ("lvh") Van Houtven, principal at Latacora, a secops and cryptography expert, tells CSO. "If someone asked me 'should I put this in my appsec report?', I'd say 'you can put it in there, but I will never let you live it down.'" Is there any reason that someone who works for a company that wants to be perpetually hired by startups to do security would poo-poo a bug bounty program? This comment seems pretty motivated. Additionally, a vulnerability is a vulnerability. Plenty of companies get owned due to pretty trivial vulnerabilities. > Moussouris, now founder and CEO of bug bounty consultancy Luta Security, questions how much of HackerOne is real. Again, could be motivated. > The bug bounty platforms' NDAs prohibit even mentioning the existence of a private bug bounty. Tweeting something like "Company X has a private bounty program over at Bugcrowd" would be enough to get a hacker kicked off their platform. Sure. How many traditional pentesters are signing NDAs? > Consider a finder who spends weeks or months of unpaid work to discover and document a security flaw. Someone else independently discovers, documents and submits that same bug five minutes before the first finder. Under the rules of most HackerOne and Bugcrowd bounty programs, the first submitter gets all the money, the second finder gets nothing. How are we proposing this alternately works in a way that isn't gameable by having control of multiple accounts? > The lack of vetting of bug bounty hunters, where anyone, including this reporter, can sign up for a HackerOne or Bugcrowd account with any email address, is the key sticking point, Antokol says. > Bugcrowd declined to elaborate on what the process of pre-vetting researchers actually looks like. So, this reporter signed up for an account and had immediate access to all public programs without any additional steps. What is really the point of this so-called journalism? In the preceding paragraphs we were complaining about NDAs stopping people talking about private programs, then complaining about the lack of vetting, then saying we gain access to the PUBLIC programs when we sign up, then saying the bug bounty companies refuse to talk about their vetting methods??? What is this? I can see why Bugcrowd and Project Zero refused to talk to this person. > Mature organizations can and should run their own VDP in house. If they are ready for an avalanche of dubious bug reports, they might optionally choose to run a bug bounty. I have a feeling that this journalist is pretty in bed with the traditional pen-testing industry. His history of articles is pretty focused. Bug bounty programs use a customer's real money to pay out bugs. Bugcrowd, at least, triages those bugs before any payment is made. It is in the interest of nobody involved to submit "dubious" bug bounty reports. The only way I can explain that opinion is to think it comes from the mouth of someone with a grudge.