2

I'm just curious as to if Stack Overflow has a bug bounty program or not..?

I'm not saying I've found a bug, but I'm also not saying I haven't. It's just a question due to the fact that many high end websites having bug bounty programs.

If the answer to this question is yes, where do I find the guidelines and the information for the bounties? If no, why not?

1

1 Answer 1

10

No bounty, but there are two kinds of intangible rewards.

  1. If you find a security vulnerability, and report it via the contact form, you get recognized on the Stack Exchange Security page.

  2. If the bug you find is of a different kind, and you report it on Meta sites, you get upvotes, and possibly badges... And if the report is on Meta Stack Exchange, also Internet points.

7
  • 1
    That's great and all, but why isn't there a bounty program?
    – 13aal
    May 8, 2016 at 2:34
  • 1
    People seem happy to report bugs as is, with 15,474 reports on meta.SE. Why pay?
    – user3717023
    May 8, 2016 at 2:35
  • 2
    Because paying gives people who are good (don't take that the wrong way) at vulnerability exploits a reason to help. I do see where you're coming from though
    – 13aal
    May 8, 2016 at 2:38
  • 1
    @13aal As far as giving actual money, that requires tax forms and all kinds of other legal paperwork, which only very large companies are equipped to handle. And as statrd, we have tons of users here willing to do it for free. Generally if the bug is significant enough to get onto the hall of fame on our security page, we will also send you a swag package as thanks. But no cold hard cash.
    – animuson StaffMod
    May 8, 2016 at 14:59
  • 1
    @animuson I understand that, but it could be worth the headache in the future is all I'm saying. So am I understanding you correctly that it's because stack doesn't want to do the paperwork?
    – 13aal
    May 8, 2016 at 15:03
  • 1
    @13aal That's a big part of it. We took down our swag store because we didn't want to do the paperwork for it. But the other part of it is we don't need to offer money to get quality reports from our users.
    – animuson StaffMod
    May 8, 2016 at 15:05
  • @animuson That makes sense thanks for clarifying
    – 13aal
    May 8, 2016 at 16:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .