Lesson 4.32: Running vulnerability disclosure and bug bounty at scale
In Intro 201 you published a disclosure policy so outsiders can report problems. A year later the programme works too well: dozens of reports, angry researchers waiting for answers, the same bug reported again and again, and payouts that look arbitrary. At master level the question isn't 'should we have a programme' but 'is ours fair, fast and actually making us safer?'. In the lab you measure Northwind's programme from its report log, check payouts against the published table, test security.txt and the policy against public standards (RFC 9116, ISO/IEC 29147 and 30111) and decide five changes.
20 min
You will learn to
- Measure a disclosure programme by outcomes, not volume
- Use duplicates as a signal of slow fixing
- Check triage against a service level
- Check payouts against a published table
- Test security.txt and safe-harbour wording against public standards
Key terms
- Vulnerability disclosure programme (VDP)
- A public way for anyone to report security problems, with rules and promises.
- Bug bounty
- A programme that pays for valid reports, usually by severity.
- Duplicate
- A report of an issue already reported; usually unpaid.
- Safe harbour
- A promise not to take legal action against good-faith research within the policy.
- security.txt
- A file at /.well-known/security.txt telling researchers how to report (RFC 9116, 2022).
- ISO/IEC 29147 and 30111
- Standards for receiving and disclosing vulnerability reports (29147) and handling them internally (30111).
← Important business services and impact tolerances · All lessons · Wildcards and path expansion →