We at Stack Overflow are interested in setting up a security bug bounty program to begin rewarding users monetarily who report serious security vulnerabilities to us, and we want to know what the community thinks. This program will be run through HackerOne where we are currently testing features internally.
Why offer money?
We’re dedicated to ensuring our users' security and have long relied on our community to report security vulnerabilities to us. We’re very grateful for all the help we’ve received from those listed in our Hall of Fame and others who have helped us out with other minor things in the past. However, it’s become clear to us that this process isn’t enough — it's become commonplace for companies to offer rewards to security researchers, and many of those top security researchers naturally spend their time on sites which offer to pay them. That is why we feel it's necessary to start offering a reward to those who dedicate their time to aiding our development efforts through reporting these vulnerabilities in a responsible way. We feel that not offering a monetary reward for these reports makes us appear to care less about the security of our users to both our users and the hacking community.
How much are you offering?
If you’re not familiar with HackerOne, you earn a varied amount based on the severity of the vulnerability, as determined by our security team. We are still deciding on the exact amounts, but we'll likely start at the lower end of the spectrum (think: hundreds, not thousands of dollars). This is one of the things we'll need to evaluate as we put the program together and test it out.
Are you finally implementing the Hacker badge?
Maybe. The idea of awarding badges for those who report vulnerabilities has come up, but we have not decided quite yet. We plan to start a separate meta post about potential badges later on. Please do not focus on the potential for badges in this discussion, as we would like to gather input on the program itself first.
Can I still get swag?
Probably not. We previously offered site swag to those users who reported serious vulnerabilities. For now, we're considering the cash bounty to be a replacement for the swag. It's possible that in the future we'll offer both, but for now offering swag and cash would just double the complexity of awarding bounties.
Do you have a timeline for implementation?
After feedback, we'll likely start with a Private Beta on HackerOne with invited users who have previously reported vulnerabilities to us that resulted in something getting fixed, particularly those on our Hall of Fame list. We'll expand that list in waves as we fix issues, respond to feedback, adjust the rules of the program, etc. The Private Beta will initially be very limited in scope (starting with only our Enterprise demo site) and expand to our full scope as we get a feel for the system.
Can I sign up for the private beta?
You absolutely can! You can fill out this form to get on the list to be considered. As stated above, those who have reported vulnerabilities to us before will receive precedence in joining the private beta. We’ll then be selecting users who have identified that they have security research background, followed by any other users. Given the short period of time the private beta may be running, not everyone who fills out the form is guaranteed to get into the private beta before the program ends up going public.
So what feedback do you want?
Anything. We realize our communities have strongly been based on the efforts of our users contributing for free and that beginning to reward users monetarily in this way can seem like it undermines the spirit of Meta and the processes we’ve had in place in the past. However, we hope that our reasoning for pursuing this option is clear and warranted and, most of all, we want our users to be on board.
If you have any further questions on something we missed or something you’d like to point out, please feel free to share your thoughts.
