5 ms·

There are bug bounties for OpenSSL. 1. https://hackerone.com/openssl https://hackerone.com/openssl 2. https://www.google.com/about/appsecurity/patch-rewards/

• midas007 13y ago
  Beware of the chilling effects of collecting Google bounties, they will claim a reward is invalid if you've blogged about the vuln outside of their timetable.
  • innoying 13y ago
    Isn't that common sense? If you disclose the bug publicly before it's patched you won't get the reward...
    • midas007 13y ago
      Sort of. But Google has a history of how it treats independent researchers.
• leoc 13y ago
  The prize money could stand to be a whole lot larger however.