12

Not that I have been looking for security issues or anything. I am just curious if they have a policy regarding people searching for and reporting potential security issues?

12
  • 1
    You mean like 100 reputation for every bug you find on SO?
    – nikolas
    Commented Sep 26, 2013 at 18:00
  • Related: Should I report a serious security issue on meta? I see no mention of a bounty. Commented Sep 26, 2013 at 18:01
  • That wasn't really what I had in mind. Just curious if there is any policy at all. Specifically are they ok with people searching for potential security bugs on their site and if they find them is there some sort of reward. Commented Sep 26, 2013 at 18:02
  • Not sure there is a reward, but from earlier such "incidents" it seems such reports are certainly welcomed. See for example Has anyone ever hacked Stack Overflow?
    – Bart
    Commented Sep 26, 2013 at 18:02
  • 6
    @AbeMiessler The reward is virtual Meta reputation that you'd gain from reporting it and the satisfaction that you're helping keep other users secure.
    – animuson StaffMod
    Commented Sep 26, 2013 at 18:03
  • Ok, so StackExchange doesn't have a problem with it's users searching for potential security issues as long as they report them to the StackExchange team? Commented Sep 26, 2013 at 18:03
  • 6
    Any organisation that is against friendly hackers will find an army of unfriendly hackers at its door (correction; through its door) Commented Sep 26, 2013 at 18:17
  • There's no bounty, but for serious issues reported responsibly they've been responsive and appreciative -- unlike some people.
    – Jeremy
    Commented Sep 26, 2013 at 18:21
  • 1
    Why should there be an (actual monetary) bug bounty program when people already do it for free?
    – John
    Commented Sep 26, 2013 at 19:00
  • 2
    @John Well, the goal is not just to encourage people to look for security issues, but to encourage the people who do find them to report them instead of abusing or selling them. (Stack Overflow did have a user abuse some issues during the private beta, but it's true that there hasn't been any abuse since then, as far as I know.)
    – Jeremy
    Commented Sep 26, 2013 at 19:18
  • 1
    The problem with a monetary (or even swag) bounty is that it also encourages folks to report lots of things that... really aren't vulnerabilities (xss that involve the victim typing scripts into the page somewhere, etc.) Definitely want folks reporting legit, exploitable problems, but would like to avoid the security equivalent of "pluralization bugs" from folks looking for t-shirts.
    – Shog9
    Commented Sep 26, 2013 at 21:03
  • 2
    T-shirt whores ruin it for everyone Commented Sep 26, 2013 at 21:28

1 Answer 1

10

There is no specific 'bounty', no.

That being said, if you post a good bug report here, you'll tend to get lots of Unicorn Points (otherwise known as Meta Reputation) for your question reporting it.

One extra thing to mention, with thanks to Jeremy (is he still on vacation?): If an exploit you find is something that could be dangerous to post publicly, you should report it privately via the Contact link on the site. This would be something that could be used destructively to the system itself, as opposed to just minor functionality hacks.

Also, you mention actively looking for vulnerabilities. The standard warning for 3rd party folks doing that would apply: Don't poke so hard that it's easy to mistake you for trying to exploit, rather than just looking for them. On the good side, though; Stack Exchange is not like some companies which can tend to react badly to legitimate reports of vulnerabilities. If you report responsibly and with honest intentions, they will react well.

6
  • 5
    Short version: SE is not evil.
    – Undo
    Commented Sep 26, 2013 at 19:23
  • 1
    Perfect, just the info I was looking for. Thanks! Commented Sep 26, 2013 at 19:57
  • 1
    If you find a serious vulnerability, you should not post it publicly, so the Unicorn Points do not apply.
    – Jeremy
    Commented Sep 26, 2013 at 20:26
  • @JeremyonVacation Oh, yes; excellent point. If it happens to be something 'dangerously' exploitable, definitely use the Contact form to report it, instead of posting here. Adding that in, with thanks! Commented Sep 26, 2013 at 20:27
  • 1
    Worth to mention it's still possible to get the hacker badge! ;) Commented Sep 26, 2013 at 20:34
  • 2
    @ShaWizDowArd Sorry, not so much.
    – Pops
    Commented Sep 26, 2013 at 20:49

Not the answer you're looking for? Browse other questions tagged .