Bug bounty programs are all about getting good guys who think like bad guys to help you protect your business from application security flaws. In this workshop Casey Ellis and Chris Raethke from Bugcrowd, The Bug Bounty Company, will go through some of the tricks and tips of setting up and running a successful bug bounty program.

1. How to run a kick-ass
bug bounty program
Casey Ellis – CEO
Chris Raethke – CTO
Bugcrowd Inc

3. AGILE
SCRUM
PAIRING
TDD
CI
BEST PRACTICE...

4. all apps have
security bugs
...REALITY

6. Current Approach

7. Bad Guys Good Guys
...help!
ARRRGGGH!

8. A Better Approach

9. Bad Guys Moar’ Good Guys
...arrrrrgh?

10. What is a bug bounty program?

11. Bug bounties are awesome…

12. …but hard.

13. The mistake *everyone* makes
DATA
PEOPLE

14. The Golden Rules

15. Respect the researcher

16. If you touch code, pay it.

17. Manage expectations

18. Normalize inputs

19. Pay quickly

20. Fix problems quickly

21. Be open about duplicates

22. Questions?
Casey Ellis – CEO
Chris Raethke – CTO
Bugcrowd Inc