4 ms·

I disagree for another reason. I don't think bug bounty is the best fit for a few reasons: * HackerOne is very expensive for most startups, IIRC it's around 30

I disagree for another reason. I don't think bug bounty is the best fit for a few reasons: * HackerOne is very expensive for most startups, IIRC it's around 30k USD/year only to be hosted on their platform (the price is probably different for different companies though.) * If one doesn't want to use a platform like HackerOne you're in a tax hell doing payments to people all over the world * The cost of paying for the bugs reported which can be massively expensive if you want to be competitive. * The time it takes to handle all reports is massive. You might imagine you get cool and interesting research but 99.9% are people copy-pasting output from automated scanners, people reporting on out of scope things, usually low severity with things like "missing x-frame-options" or just straight up false positives. It's both frustrating, demotivating and time consuming. I think a self hosted responsible disclosure program is better and more sustainable for most startups. Add a security.txt [0] to the website. You might still get a bunch of low quality reports but at least you give people a structured way of disclosing findings. 0. https://securitytxt.org/ https://securitytxt.org/

davedx 6y ago
> If one doesn't want to use a platform like HackerOne you're in a tax hell doing payments to people all over the world Why would the company paying be in tax hell? The recipient is the one who needs to pay income tax
- DrRobinson 6y ago
  I actually don't know the exact details, I don't work with finance but that's one of the problems we identified when looking into it. I think it has do do with how bug bounties generally work. Since bug hunters aren't sending an invoice from a registered company you have to pay employer tax or similar. But as I mentioned, I'm not entirely sure since I don't work with that part. It might also differ depending on where the company is registered.
- kds3 6y ago
  > The recipient is the one who needs to pay income tax That's only in some countries like US. There are many HackerOne bug hunters from e.g. Russia where your company is responsible for paying all taxes including employee income tax.

davedx 6y ago

> If one doesn't want to use a platform like HackerOne you're in a tax hell doing payments to people all over the world Why would the company paying be in tax hell? The recipient is the one who needs to pay income tax

DrRobinson 6y ago
I actually don't know the exact details, I don't work with finance but that's one of the problems we identified when looking into it. I think it has do do with how bug bounties generally work. Since bug hunters aren't sending an invoice from a registered company you have to pay employer tax or similar. But as I mentioned, I'm not entirely sure since I don't work with that part. It might also differ depending on where the company is registered.
kds3 6y ago
> The recipient is the one who needs to pay income tax That's only in some countries like US. There are many HackerOne bug hunters from e.g. Russia where your company is responsible for paying all taxes including employee income tax.