Thanks for the advice.
I'm frustrated because adding this page made us a target whereas we weren't one before. I agree we would have eventually become a target regardless, but hopefully this would be because we have a well-known product.
back
2 comments
Bug bounties are not fun to manage. If it's any consolation, you should take heart in the fact that they are a pain in the ass for everyone running them. Everyone submitting is rude. Every "vulnerability" is a critical one. They all urge you to "please fix this right away." Prepare to get nmap scan reports that are piped over smtp.
I encourage you to harden your heart. A reward/recognition page is a small price to pay for avoiding an embarassing compromise.
If you really want to quash the general issue, pay some 3rd party to do some real csrf/xss/sql injection pen testing against your sight at the cadence that is appropriate for your dev cycle. If you move slow and deliberately, annual or semi-annual assessments can help you intercept the disclosures. If you're more agile, you'll need to consider something more embedded in your life cycle.
A few other thoughts:
1) Develop your copy pasta for your accept, reject and duplicate submissions. Write in a firm but appreciative tone.
2) For email from anklebiting submitters, refer to your policy. Your policy should say whatever you need it to say. If people want to dispute things, always express appreciation for their effort, but point to "the policy" as the reason things can't be the way they want them.
3) prepare for crazy people. Vuln reward/recognition programs really seem to bring out the old school bbs conspiracy theorists.
Thanks. I wasn't thinking that I was setting up a bug bounty program when I created the page, I just wanted to thank people who had helped us so far. I didn't realise what I was getting myself into, so I felt a bit over my head. But you're right there are ways we can make things go smoother.
You have always been a target. Sucks, I agree. At least now you have a sense of the scope of it; the nice guys are a small subset of the total threat.