4 ms·

You know people making 500k/yr on HackerOne? That seems way higher than what I would estimate from anecdotes. Unless you’re talking about private exploit sales

• LilBytes 6y ago
  It's definitely possible. A few of the researchers I've seen on BugCrowd that we help foster good relationships with, e.g. paying out quickly and with sizeable bounties, easily make 5 figures USD from us in 12 months. And I'd hope we are only one of their many clients. We might be an outsider though, my company does very well to address the bugs that are brought to us fairly. We understand the need to encourage the top 100 researchers on the platform an incentive to look over our stack. That's where the value is. We do get a lot of spammy notifications too which sucks but it's part and parcel with the issue mentioned here. We leverage BugCrowd to help filter the chaff from the precious metals. :)
• lawnchair_larry 6y ago
  Found some data about this: https://www.hackerone.com/press-release/six-hackers-break-bug-bounty-record-earning-over-1-million-each-hackerone https://www.hackerone.com/press-release/six-hackers-break-bu... As of that date, 6 people made over $1M total since it launched (not per year). So maybe 1 or 2 have hit 500k in a year? Some of those names have been doing it for over 6 years. According to a previous report, only 0.3% have made over $5k in their lifetime on the platform. https://duo.com/decipher/taking-hype-out-of-bug-bounty-programs https://duo.com/decipher/taking-hype-out-of-bug-bounty-progr...
  • rfkrishnan 6y ago
    There are numerous Synack Red Team member millionaires too. The first in hacker history was an SRT member in mid-2018, but didn't want publicity. - Rajesh Krishnan, Synack