A HackerOne platform that enables security researchers to inform companies and software developers about identified vulnerabilities and earn rewards for it has announced the inclusion of open-source software in the scope of the Internet Bug Bounty project. Rewards can now be awarded not only for discovering vulnerabilities in corporate systems and services but also for reporting issues in a wide range of open projects developed by both teams and individual developers.
Among the first open projects for which rewards for identified vulnerabilities have begun to be provided are Nginx, Ruby, RubyGems, Electron, OpenSSL, Node.js, Django, and Curl. The list will be expanded further. A reward of $5000 is provided for a critical vulnerability, $2500 for a dangerous one, $1500 for a medium risk, and $300 for a low risk. The bounty for a discovered vulnerability is distributed in the following way: 80% to the researcher who reported the vulnerability and 20% to the maintainer of the open project who implemented the fix.
Funds to finance the new program are accumulated in a separate pool. The main sponsors of the initiative include Facebook, GitHub, Elastic, Figma, TikTok, and Shopify, and HackerOne users have the opportunity to donate from 1% to 10% of the allocated funds to the pool.
Forrás: opennet.ru
