12

Not that I have been looking for security issues or anything. I am just curious if they have a policy regarding people searching for and reporting potential security issues?

12
  • 1
    You mean like 100 reputation for every bug you find on SO? – nijansen Sep 26 '13 at 18:00
  • Related: Should I report a serious security issue on meta? I see no mention of a bounty. – Martijn Pieters Sep 26 '13 at 18:01
  • That wasn't really what I had in mind. Just curious if there is any policy at all. Specifically are they ok with people searching for potential security bugs on their site and if they find them is there some sort of reward. – Abe Miessler Sep 26 '13 at 18:02
  • Not sure there is a reward, but from earlier such "incidents" it seems such reports are certainly welcomed. See for example Has anyone ever hacked Stack Overflow? – Bart Sep 26 '13 at 18:02
  • 6
    @AbeMiessler The reward is virtual Meta reputation that you'd gain from reporting it and the satisfaction that you're helping keep other users secure. – animuson Sep 26 '13 at 18:03
  • Ok, so StackExchange doesn't have a problem with it's users searching for potential security issues as long as they report them to the StackExchange team? – Abe Miessler Sep 26 '13 at 18:03
  • 6
    Any organisation that is against friendly hackers will find an army of unfriendly hackers at its door (correction; through its door) – Richard Tingle Sep 26 '13 at 18:17
  • There's no bounty, but for serious issues reported responsibly they've been responsive and appreciative -- unlike some people. – Jeremy Sep 26 '13 at 18:21
  • 1
    Why should there be an (actual monetary) bug bounty program when people already do it for free? – John Sep 26 '13 at 19:00
  • 2
    @John Well, the goal is not just to encourage people to look for security issues, but to encourage the people who do find them to report them instead of abusing or selling them. (Stack Overflow did have a user abuse some issues during the private beta, but it's true that there hasn't been any abuse since then, as far as I know.) – Jeremy Sep 26 '13 at 19:18
  • 1
    The problem with a monetary (or even swag) bounty is that it also encourages folks to report lots of things that... really aren't vulnerabilities (xss that involve the victim typing scripts into the page somewhere, etc.) Definitely want folks reporting legit, exploitable problems, but would like to avoid the security equivalent of "pluralization bugs" from folks looking for t-shirts. – Shog9 Sep 26 '13 at 21:03
  • 2
    T-shirt whores ruin it for everyone – Abe Miessler Sep 26 '13 at 21:28
10

There is no specific 'bounty', no.

That being said, if you post a good bug report here, you'll tend to get lots of Unicorn Points (otherwise known as Meta Reputation) for your question reporting it.

One extra thing to mention, with thanks to Jeremy (is he still on vacation?): If an exploit you find is something that could be dangerous to post publicly, you should report it privately via the Contact link on the site. This would be something that could be used destructively to the system itself, as opposed to just minor functionality hacks.

Also, you mention actively looking for vulnerabilities. The standard warning for 3rd party folks doing that would apply: Don't poke so hard that it's easy to mistake you for trying to exploit, rather than just looking for them. On the good side, though; Stack Exchange is not like some companies which can tend to react badly to legitimate reports of vulnerabilities. If you report responsibly and with honest intentions, they will react well.

6
  • 5
    Short version: SE is not evil. – Undo Sep 26 '13 at 19:23
  • 1
    Perfect, just the info I was looking for. Thanks! – Abe Miessler Sep 26 '13 at 19:57
  • 1
    If you find a serious vulnerability, you should not post it publicly, so the Unicorn Points do not apply. – Jeremy Sep 26 '13 at 20:26
  • @JeremyonVacation Oh, yes; excellent point. If it happens to be something 'dangerously' exploitable, definitely use the Contact form to report it, instead of posting here. Adding that in, with thanks! – Andrew Barber Sep 26 '13 at 20:27
  • 1
    Worth to mention it's still possible to get the hacker badge! ;) – Shadow The Vaccinated Wizard Sep 26 '13 at 20:34
  • 2
    @ShaWizDowArd Sorry, not so much. – Pops Sep 26 '13 at 20:49

Not the answer you're looking for? Browse other questions tagged .