Timeline for Setting Up a HackerOne Security Bug Bounty Program
Current License: CC BY-SA 3.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 3, 2020 at 13:30 | history | edited | CommunityBot |
Commonmark migration
|
|
| Jun 22, 2017 at 10:57 | comment | added | Simon | Thanks Jeremy, I'm reminded of Alec when he was at Facebook saying everything is harder at scale. Looks like you've mostly sorted the redirects, and the max-age can probably be bumped up if no major issues remain. Also no one ever mentions "max-age 0" for when you screw up at scale | |
| Jun 22, 2017 at 9:24 | comment | added | Michał Perłakowski | FYI, there already is a feature request on Meta to enable CSP. | |
| S Jun 21, 2017 at 18:26 | history | suggested | Kyle Williamson | CC BY-SA 3.0 |
Added link to mentioned blog
|
| Jun 21, 2017 at 17:35 | review | Suggested edits | |||
| S Jun 21, 2017 at 18:26 | |||||
| Jun 21, 2017 at 17:33 | comment | added | Jeremy StaffMod | Thanks for the input and interesting threat scenario. I know this doesn't address the core point of your post, but if you're curious, the reasons that HSTS max-age is currently so low and that subdomains aren't included are discussed in Nick Craver's blog post about rolling out HTTPS, and he briefly addressed some of those security headers here. | |
| Jun 21, 2017 at 17:00 | history | answered | Simon | CC BY-SA 3.0 |