Heroku Security Bug Bounty

#1

Post by leahculver » Thu, Apr 17, 2014, 6:08 PM UTC

Heroku Security Bug Bounty
blog.heroku.com

Re: Heroku Security Bug Bounty

#2

Post by oijaf888 » Thu, Apr 17, 2014, 7:32 PM UTC

I wonder why they chose BugCrowd over the seemingly significantly cheaper HackerOne?

Re: Heroku Security Bug Bounty

#3

Post by daeken » Thu, Apr 17, 2014, 7:53 PM UTC

> As part of Heroku and our parent company Salesforce.com’s commitment to philanthropy, if you are interested in donating your bounty to a recognized charity we will match it dollar-for-dollar.

Kudos to the Heroku folks for this. I haven't seen any other bug bounty program doing this (I'd love to be wrong -- please let me know if I am!), and it's a very nice change from the norm.

Re: Heroku Security Bug Bounty

#4

Post by badhairday » Thu, Apr 17, 2014, 8:07 PM UTC

daeken wrote: post #3

> As part of Heroku and our parent company Salesforce.com’s commitment to philanthropy, if you are interested in donating your bounty to a recognized charity we will match it dollar-for-dollar. Kudos to the Heroku folks for this. I haven't seen any other bug bounty program doing this (I'd love to be wrong -- please let me know if I am!), and it's a very nice change from the norm.

Yes! Reading that part put a smile on my face.

Re: Heroku Security Bug Bounty

#5

Post by jon-wood » Thu, Apr 17, 2014, 8:19 PM UTC

daeken wrote: post #3

> As part of Heroku and our parent company Salesforce.com’s commitment to philanthropy, if you are interested in donating your bounty to a recognized charity we will match it dollar-for-dollar. Kudos to the Heroku folks for this. I haven't seen any other bug bounty program doing this (I'd love to be wrong -- please let me know if I am!), and it's a very nice change from the norm.

Google also match anyone who donates their bounty to charity.

Re: Heroku Security Bug Bounty

#6

Post by infosectosser » Thu, Apr 17, 2014, 8:35 PM UTC

oijaf888 wrote: post #2

I wonder why they chose BugCrowd over the seemingly significantly cheaper HackerOne?

I would guess it is precisely because BugCrowd is more expensive. They offer a managed program where BugCrowd's employees validate bug reports for participating companies. Speaking from experience, that process can become very time-consuming.

Re: Heroku Security Bug Bounty

#7

Post by [deleted] » Thu, Apr 17, 2014, 8:42 PM UTC

daeken wrote: post #3

> As part of Heroku and our parent company Salesforce.com’s commitment to philanthropy, if you are interested in donating your bounty to a recognized charity we will match it dollar-for-dollar. Kudos to the Heroku folks for this. I haven't seen any other bug bounty program doing this (I'd love to be wrong -- please let me know if I am!), and it's a very nice change from the norm.

[deleted]

Re: Heroku Security Bug Bounty

#8

Post by EricDeb » Thu, Apr 17, 2014, 11:53 PM UTC

infosectosser wrote: post #6

oijaf888 wrote: post #2

I wonder why they chose BugCrowd over the seemingly significantly cheaper HackerOne?

I would guess it is precisely because BugCrowd is more expensive. They offer a managed program where BugCrowd's employees validate bug reports for participating companies. Speaking from experience, that process can become very time-consuming.

If I were running a startup or even a moderately-sized company, implementing and managing a bug bounty program internally sounds like a headache, and probably would be put off indefinitely. A managed solution like BugCrowd could definitely fill this void.