"The Best way to improve Network security is hiring hackers" Unfortunately, companies can't hire all best hackers. So the companies has chosen another best way to improve their system security, "Bug Bounty Programs".
Bug Bounty program is the place where Security researchers and Ethical hackers love to find vulnerabilities in target website or app and get rewarded for their findings.
Here is the list of Bug bounty programs that offers reward for security researchers who find vulnerabilities.
If you find vulnerability in google , you will get reward as well as your name will be listed in the Google Hall of fame page.
Details about Vulnerability Reward Program: http://www.google.com/about/appsecurity/reward-program/
Hall of fame: http://www.google.com/about/appsecurity/hall-of-fame/
The following table outlines the usual rewards for the anticipated classes of bugs:
|Vulnerability type||accounts.google.com||Other highly sensitive services ||Normal Google applications||Non-integrated acquisitions and other lower priority sites |
|Remote code execution||$20,000||$20,000||$20,000||$5,000|
|SQL injection or equivalent||$10,000||$10,000||$10,000||$5,000|
|Significant authentication bypass or information leak||$10,000||$5,000||$1,337||$500|
|XSRF, XSSI and other common web flaws||$500 - $3,133.7 |
(depending on impact)
|$500 - $1,337 |
(depending on impact)
Security Bug Bounty from facebook:
Minimum reward is $500 USD.
The reward will be increased for severe or creative bugs
Only 1 bounty per security bug will be awarded
Mozilla Bug Bounty program:
The Mozilla Security Bug Bounty Program is designed to encourage security research in Mozilla software and to reward those who help us create the safest Internet clients in existence.
The bounty for valid web applications or services related security bugs, the are giving a range starting at $500 (US) for high severity and, in some cases, may pay up to $3000 (US) for extraordinary or critical vulnerabilities. they will also include a Mozilla T-shirt.
Paypal Bug Bounty Program For Professional Researchers
Secunia Vulnerability Coordination Reward Program (SVCRP)
SVCRP – a reward program incentive offered by Secunia to researchers who have discovered a vulnerability and would like a third party to confirm their findings and handle the coordination process with the vendor on their behalf: http://secunia.com/community/research/svcrp/
Will pay a minimum of $500 for qualifying vulnerabilities, subject to a few conditions and with qualification determined by the Etsy Security Team.
Companies that mentions researcher name in the site but won't give bounties.
Adobe Systems Incorporated:
Security Acknowledgments : http://www.adobe.com/support/security/bulletins/securityacknowledgments.html
Nokia Siemens Networks
Yandex Bug Bounty: