"The Best way to improve Network security is hiring hackers" Unfortunately, companies can't hire all best hackers. So the companies has chosen another best way to improve their system security, "Bug Bounty Programs".
Bug Bounty program is the place where Security researchers and Ethical hackers love to find vulnerabilities in target website or app and get rewarded for their findings.
Here is the list of Bug bounty programs that offers reward for security researchers who find vulnerabilities.
Google:
If you find vulnerability in google , you will get reward as well as your name will be listed in the Google Hall of fame page.
Details about Vulnerability Reward Program: http://www.google.com/about/appsecurity/reward-program/
Hall of fame: http://www.google.com/about/appsecurity/hall-of-fame/
The following table outlines the usual rewards for the anticipated classes of bugs:
| Vulnerability type | accounts.google.com | Other highly sensitive services [1] | Normal Google applications | Non-integrated acquisitions and other lower priority sites [2] |
|---|---|---|---|---|
| Remote code execution | $20,000 | $20,000 | $20,000 | $5,000 |
| SQL injection or equivalent | $10,000 | $10,000 | $10,000 | $5,000 |
| Significant authentication bypass or information leak | $10,000 | $5,000 | $1,337 | $500 |
| Typical XSS | $3,133.7 | $1,337 | $500 | $100 |
| XSRF, XSSI and other common web flaws | $500 - $3,133.7 (depending on impact) | $500 - $1,337 (depending on impact) | $500 | $100 |
Security Bug Bounty from facebook:
Minimum reward is $500 USD.
The reward will be increased for severe or creative bugs
Only 1 bounty per security bug will be awarded
https://www.facebook.com/whitehat/bounty
Mozilla Bug Bounty program:
The Mozilla Security Bug Bounty Program is designed to encourage security research in Mozilla software and to reward those who help us create the safest Internet clients in existence.
The bounty for valid web applications or services related security bugs, the are giving a range starting at $500 (US) for high severity and, in some cases, may pay up to $3000 (US) for extraordinary or critical vulnerabilities. they will also include a Mozilla T-shirt.
http://www.mozilla.org/security/bug-bounty.html
Paypal Bug Bounty Program For Professional Researchers
https://www.paypal.com/us/webapps/mpp/security/reporting-security-issues
Secunia Vulnerability Coordination Reward Program (SVCRP)
SVCRP – a reward program incentive offered by Secunia to researchers who have discovered a vulnerability and would like a third party to confirm their findings and handle the coordination process with the vendor on their behalf: http://secunia.com/community/research/svcrp/
Etsy :
Will pay a minimum of $500 for qualifying vulnerabilities, subject to a few conditions and with qualification determined by the Etsy Security Team.
http://codeascraft.etsy.com/2012/09/11/announcing-the-etsy-security-bug-bounty-program/
Barracuda Networks
www.barracudalabs.com/bugbounty
Companies that mentions researcher name in the site but won't give bounties.
Adobe Systems Incorporated:
Details :http://www.adobe.com/support/security/alertus.html
Security Acknowledgments : http://www.adobe.com/support/security/bulletins/securityacknowledgments.html
Twitter:
https://twitter.com/about/security
EBay:
http://pages.ebay.com/securitycenter/ResearchersAcknowledgement.html
Microsoft
http://technet.microsoft.com/en-us/security/ff852094.aspx
http://technet.microsoft.com/en-us/security/cc308589
http://technet.microsoft.com/en-us/security/cc308575
http://technet.microsoft.com/en-us/security/cc261624
http://www.microsoft.com/security/msrc/default.aspx
Apple
http://support.apple.com/kb/HT1318
https://ssl.apple.com/support/security/
Dropbox
https://www.dropbox.com/security
https://www.dropbox.com/special_thanks
http://code.reddit.com/wiki/help/whitehat
Github
https://help.github.com/articles/responsible-disclosure-of-security-vulnerabilities
Ifixit
http://www.ifixit.com/Info/responsible_disclosure
37 Signals
http://37signals.com/security-response
Twilio
http://www.twilio.com/blog/2012/03/reporting-security-vulnerabilities.html
Constant Contact
http://www.constantcontact.com/about-constant-contact/security/report-vulnerability.jsp
Engine Yard
http://www.engineyard.com/legal/responsible-disclosure-policy
Lastpass
https://lastpass.com/support_security.php
RedHat
https://access.redhat.com/knowledge/articles/66234
Acquia
https://www.acquia.com/how-report-security-issue
Zynga
http://company.zynga.com/security/whitehats
Owncloud
http://owncloud.org/security/policy
http://owncloud.org/security/hall-of-fame
Tuenti
http://corporate.tuenti.com/en/dev/hall-of-fame
soundcloud:
http://help.soundcloud.com/customer/portal/articles/439715-responsible-disclosure
Nokia Siemens Networks
http://www.nokiasiemensnetworks.com/about-us/responsible-disclosure
Yandex Bug Bounty:
http://company.yandex.com/security/hall-of-fame.xml
