Not that I have been looking for security issues or anything. I am just curious if they have a policy regarding people searching for and reporting potential security issues?
-
1You mean like 100 reputation for every bug you find on SO?– nikolasSep 26, 2013 at 18:00
-
Related: Should I report a serious security issue on meta? I see no mention of a bounty.– Martijn PietersSep 26, 2013 at 18:01
-
That wasn't really what I had in mind. Just curious if there is any policy at all. Specifically are they ok with people searching for potential security bugs on their site and if they find them is there some sort of reward.– Abe MiesslerSep 26, 2013 at 18:02
-
Not sure there is a reward, but from earlier such "incidents" it seems such reports are certainly welcomed. See for example Has anyone ever hacked Stack Overflow?– BartSep 26, 2013 at 18:02
-
6@AbeMiessler The reward is virtual Meta reputation that you'd gain from reporting it and the satisfaction that you're helping keep other users secure.– animuson StaffModSep 26, 2013 at 18:03
-
Ok, so StackExchange doesn't have a problem with it's users searching for potential security issues as long as they report them to the StackExchange team?– Abe MiesslerSep 26, 2013 at 18:03
-
6Any organisation that is against friendly hackers will find an army of unfriendly hackers at its door (correction; through its door)– Richard TingleSep 26, 2013 at 18:17
-
There's no bounty, but for serious issues reported responsibly they've been responsive and appreciative -- unlike some people.– JeremySep 26, 2013 at 18:21
-
1Why should there be an (actual monetary) bug bounty program when people already do it for free?– JohnSep 26, 2013 at 19:00
-
2@John Well, the goal is not just to encourage people to look for security issues, but to encourage the people who do find them to report them instead of abusing or selling them. (Stack Overflow did have a user abuse some issues during the private beta, but it's true that there hasn't been any abuse since then, as far as I know.)– JeremySep 26, 2013 at 19:18
-
1The problem with a monetary (or even swag) bounty is that it also encourages folks to report lots of things that... really aren't vulnerabilities (xss that involve the victim typing scripts into the page somewhere, etc.) Definitely want folks reporting legit, exploitable problems, but would like to avoid the security equivalent of "pluralization bugs" from folks looking for t-shirts.– Shog9Sep 26, 2013 at 21:03
-
2T-shirt whores ruin it for everyone– Abe MiesslerSep 26, 2013 at 21:28
Add a comment
|
1 Answer
There is no specific 'bounty', no.
That being said, if you post a good bug report here, you'll tend to get lots of Unicorn Points (otherwise known as Meta Reputation) for your question reporting it.
One extra thing to mention, with thanks to Jeremy (is he still on vacation?): If an exploit you find is something that could be dangerous to post publicly, you should report it privately via the Contact link on the site. This would be something that could be used destructively to the system itself, as opposed to just minor functionality hacks.
Also, you mention actively looking for vulnerabilities. The standard warning for 3rd party folks doing that would apply: Don't poke so hard that it's easy to mistake you for trying to exploit, rather than just looking for them. On the good side, though; Stack Exchange is not like some companies which can tend to react badly to legitimate reports of vulnerabilities. If you report responsibly and with honest intentions, they will react well.
answered Sep 26, 2013 at 19:21
-
5
-
1
-
1If you find a serious vulnerability, you should not post it publicly, so the Unicorn Points do not apply.– JeremySep 26, 2013 at 20:26
-
@JeremyonVacation Oh, yes; excellent point. If it happens to be something 'dangerously' exploitable, definitely use the Contact form to report it, instead of posting here. Adding that in, with thanks! Sep 26, 2013 at 20:27
-
1Worth to mention it's still possible to get the hacker badge! ;) Sep 26, 2013 at 20:34
-
2