How we run our bug bounty program

segment.com

64 pointsleifdreizler6 comments

"All of our most critical submissions have come from researchers that were originally rewarded for a well-written duplicate."

I think that's a key line that should have been added to the top tips.

Thanks for reading my blog. I tried to keep the "top tips" short and thought this was partially captured via

- Pay for anything that brings value - Pay extra for well-written reports, even if they’re dupes

with the hopes that if someone saw this and wanted to read more they'd skim through the blog :)

I have question to your bug bounty program. What's the best way to reach you?

@leifdreizler on twitter! LinkedIn is also fine but I don't check it as regularly

Not a segment specific question, but if I discover a bug while working on a task for my employer, will that bounty be discounted off the bill or will it go to me directly? what's typical?

It's best-practice to get permission from your employer to submit bugs you discover on their time to bounty services, and then for you to collect the entire bounty. It's common for people just to quietly submit bounties; I wouldn't, but then I work in a field where it's a big deal to disclose on-the-job findings. You might not.

Reply on news.ycombinator.com