YesWeHackEDU, a fully-fledged educational platform, mobilises real-world hacking techniques for training purposes. YesWeHackEDU provides a reliable approach for reporting vulnerabilities and is a tangible evaluation tool. The platform offers free subscriptions for two months starting from 1 April to help universities during the COVID19 outbreak.

Through getting together ethical hackers (‘bug hunters’), and organisations committed to improving their cybersecurity, bug bounty platforms play an essential role in implementing coordinated vulnerability disclosure and surfacing bugs to reduce cyber risk.

Cybersecurity is both an economic and societal issue. Yet, this sector suffers from an imbalance between the state of the threat and the market’s defence capabilities. Thus, the capacity of public and private actors to detect and correct shortcomings professionally and ethically must be rapidly strengthened. To remedy that imbalance, we need comprehensive training and better information sharing.

 in November 2019, a unique and fully-fledged educational platform aimed at students and teaching crew alike. Due to the current 

, we have decided to provide basic two-month free licences to learners and instructors, enabling skill-building to continue despite the pandemic.

 self-education: complementary yet insufficient

Although more and more universities and training initiatives sprawl, they are unlikely to mitigate the growing skills shortage. Formal cybersecurity education is unable to replenish the talent pool at a pace that follows the increasing complexity of cybersecurity challenges. In contrast, an overwhelming majority of ethical hackers operating today are self-taught. Self-education is possible thanks to abundant online resources and expanding events which increasingly feature a Capture-the-Flag (CTF) type of activities.

Both formal education and self-training have shortcomings. University curricula remain too theoretical, students setting foot in real-world operations solely during their internship. The latter often happens at the Bachelor or Master’s level. Pluridisciplinarity is still challenging to achieve, a hurdle especially damaging to cybersecurity and computer science curricula.

Self-education, on the other side, relies on the individual’s commitment and ability to identify security-focused courses available and select the ones most relevant to the issue at hand. Even with a performant self-directed learning resource set at hand, 

 in online education, albeit their role becomes one of a learning catalyst and knowledge navigator.

The broader connected society understands the challenge. The outcome is new education tools for security, aiming to solve the cybersecurity skills gap through an approach outside the classroom. Both free and paid-for coursework designed by ethical hackers features amongst those tools, all encouraging and relying on collaboration into the cybersecurity community.

The bug bounty platforms all have a dedicated “Resources” page. A closer examination of these pages, however, concludes to a high uniformity of available content.

YesWeHackEDU builds bridges between universities and communities

Bug bounty programs include concrete incentive structures and processes designed to encourage individuals with a range of experience and talent to identify and report potential security vulnerabilities. Embracing this idea requires a real sense of agency on the individuals. Yet, relying on the person alone is short-sighted at best. Collaboration through practical situation awareness thus leverages an innovative way for formal education to keep up with the rapidly evolving talent need landscape.

 is a unique and fully-fledged educational platform in both its approach and outreach. It mobilises real-world data in a structured way. Alongside diverse training environments matching different student levels, YesWeHackEDU provides a reliable methodological approach to vulnerability report composition and constitutes a tangible evaluation tool.

Academia needs to capitalise on the available online tools for teaching and welcome innovative approaches to training. YesWeHackEDU is one such progressive development. Three main educational scenarios made possible by YesWeHackEDU: as part of a cybersecurity curriculum; as a module for Computer Science curricula more broadly (e.g. software development, data science); as part of life-long learning programs.

YesWeHackEDU as part of a formal cybersecurity curriculum

Crowdsourced security invests organisations with the skills, experience and nonstop coverage of creative and experienced security researchers. These hunters work to identify vulnerabilities before criminals exploit them. Such a proven model for crowdsourcing the right expertise, applying it when and where need be, and rewarding for results is what YesWeHackEDU enables in the classroom.

Through engaging students and the teaching crew with the training environment, YesWeHackEDU offers a blended learning approach for cybersecurity curricula. The educational set-up streamlines learning effectiveness in building upon students’ pre-existing technical knowledge and fostering their proactivity, autonomy and rigour. Since YesWeHackEDU reliably tracks contributions, teachers can follow progress and grade based on a formal and harmonious delivery process.

The ongoing COVID19 outbreak has drawn learners and teachers away from the classroom. Still, cybercriminals are riding the pandemic wave, often adding a cyber crisis to the health crisis. 

’s mission to build bridges between ethical hackers and organisations, we have decided to provide free licences to any university, starting 1 April. Those licences span two months.

They will enable teachers and students alike to benefit from top-notch pedagogical resources during the COVID19 pandemic.

YesWeHackEDU: Addressing talent shortage through Bug Bounty

Why did you implement a bug bounty program?

We’ve been ISO 27001 certified since 2014 and are mandated to use penetration testing to seek out vulnerabilities. At first, the penetration testing proved useful. Over time however, they produced fewer exciting outcomes. We quickly realised that owing to the limited duration of an audit (2-3 weeks), the penetration tester didn’t have the time to identify more severe vulnerabilities. At best, he or she had hunches, but then we needed to work on them.

 had been working well in the U.S. Household name brands were using the approach.

We explored red team and bug bounty, with researchers coming from diverse backgrounds to test our scopes and discover new vulnerabilities.

If we’d gone with red team, we’d have encountered the same problem we had with the classic penetration testing I mentioned before. So, we chose to launch a bug bounty in the belief that, although the penetration testers were no longer finding anything, that didn’t mean there weren’t other problems.

We started with a private program collaborating with approximately 15 hunters because we weren’t ‘sure’ about our applications. The hunters identified some significant vulnerabilities. We gradually invited more hunters before finally going public with two scopes: our infrastructure service and our customer portal.

Can you describe the evolution and development of your program?

It was reasonably quick – one year – to implement the program. When we went public, we didn’t experience a sharp spike in vulnerabilities: we started with a grid of very reasonable bonuses, which we gradually increased to reactivate hunter activity on our program to reach our current ‘cruising speed’.

Did sovereignty influence your decision to work with YesWeHack?

Yes, definitely. When we considered bug bounty, we were aiming for both the 

 certification. It therefore seemed more opportune for us to work with a French partner, giving us solid guarantees on how our data is managed.

Is working with a sovereign platform an asset for you in the way you approach your market?

Yes, the concept of sovereignty is essential to our French and European customers. Those include public and para-public organisations, as well as organisations of strategic importance (

OIV or Operators of Vital Importance; abbreviated as per its French naming

), that are sensitive to the issues of sovereignty and control of their data. In the context of cloud services provisioning, partnering with a sovereign platform like 

 assures our customers that the end-to-end vulnerabilities processing chain is controlled effectively.

 a competitive advantage because it guarantees active security: where we once performed biannual penetration testing and periodic scans, we’re now looking for vulnerabilities continuously. The moment a hunter signals a vulnerability, we’re able to include it in our correction cycle automatically. Our customers are reassured, knowing that we don’t wait for updates from vendors to fix our vulnerabilities. Also, we’re able to detect and fix vulnerabilities in our products we develop in-house.

First, hunters don’t face any time constraints. They can take the time they need to detect sophisticated vulnerabilities, further develop an exploit, suggest remediation, and write up a detailed report. By contrast, penetration testing often results in a few scans and two or three CVEs, without any concrete proof of exploitations.

The diversity of the community is another advantage: I can exchange with hunters specialising in UI, for example, and others in application services. Each of them offers different, complicated things that a ‘non-specialised’ auditor could never find. Sometimes, I think you have to be crazy to notice stuff like that!

I have access to a wealth of expertise. They find things that no-one else could.

My team are familiar with different approaches, through talking to people with different approaches to vulnerability management. We sometimes have to explain that a finding isn’t a vulnerability, but rather a misuse at their end and so on.

Last but not least, a bond builds up over time with individual hunters. If a researcher has found significant vulnerabilities, and he or she wants to test more complex things, then we give them the resources or access to do more exciting stuff. This in-depth, collaborative approach is impossible to achieve with penetration testers who are consistently overwhelmed and caught up with their tight deadlines.

Do bug bounty programs spell the end of penetration testing? Or will they remain complementary?

In my opinion, they are two completely approaches: I use penetration testing for their certifying value and to comply with specific standards, which allows me to satisfy customers requiring these certifications. Meanwhile, bug bounty meets the need for more operational security and to focus on all the things that penetration testing and classic scans aren’t able to detect.

Have you seen any changes in your teams since Outscale began using bug bounty?

At the SOC (security operations centre), we manage the existing programs, bonuses, and relationships with the hunters, the creation of new programs, and any changes in the scopes. The bug bounty reports come to my SOC team, which then qualifies each vulnerability.

In 90 percent of cases, they are non-critical vulnerabilities that are quickly qualified. If there is any doubt, we discuss it in-house. If the vulnerability is particularly interesting, the person in charge of managing it presents it to the team. We then talk about its potential impact, the solutions we can use, the hunter’s recommendations, and how we can ensure it doesn’t come up again. These exchanges increase the skills of the entire team.

Does this also mean your teams collaborate more closely?

Yes, because it stimulates curiosity; people are interested and want to understand. It’s always more concrete to show a real vulnerability that has taken place on the platform.

Are your teams and the organisation more agile?

We work in continuous integration, and bug bounty lent itself to our agile methods.

When we receive a vulnerability report, we qualify the CVSS score and, based on that score, we determine the remediation deadline. The report is then sent directly to the relevant teams for correction. The same applies to the dependencies used in the code; they’re sent to R&D for analysis and version upgrade. In every case, bug bounty is an entry point like any other, and as such, vulnerabilities are managed via tickets.

We adapt the processing according to the urgency: if a rapid correction is required, we deliver a patch immediately, to be reinstated in the next version. In this case, we create (or modify) a user story using these new elements, which will serve as a basis for developments.

We will expand our scopes in the programs. We will also encourage hunters to ‘go deep’ inside our product (beyond the web-based front-end). And we will increase the bonus grid.

I’d also like to give them access to our private platforms so they can perform more stringent tests. We’ve already tried this once, and it produced insightful results, with hard-coded data extraction scenarios, on our test platforms. However, this involves giving hunters specific testing scopes, which is time-consuming.

Founded in 2015, YesWeHack is the #1 European Bug Bounty & VDP Platform.

YesWeHack offers companies an innovative approach to cybersecurity with Bug Bounty (pay-per-vulnerability discovered), connecting tens of thousands cybersecurity experts (ethical hackers) across 170 countries with organisations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices.

YesWeHack runs private (invitation based only) programs and public programs for hundreds of organisations worldwide in compliance with the strictest European regulations.

 (VDP), a learning platform for ethical hackers called 

 and a training platform for educational institutions, 

How Outscale secures its sovereign cloud with YesWeHack

 was rather tricky: you needed to solve an obfuscated XPath request to derive working serials

. The 3 first hunters to solve this challenge are rewarded a prestigious 

 geared towards learning bug exploitation the fun and visual way.

The DOJO is three things in one: a learning tool, training platform and a playground.

The DOJO is the arena where the 4th challenge took place (see the 

We are glad to announce the #4 DOJO Challenge winners list.

 feeds to be notified of the upcoming challenges.

Read on to find the best write-up as well as the challenge author’s recommendations. For this instalment of the DOJO Challenges, we have selected two write-ups as their approaches are distinct and rely on different tools. Read on then!

You have to find the seven valid serials returning the Access granted! string from the XPath query. The $serial input is filtered to restrict the input to the use of digits and hyphen (-) and 19 characters. The serials format is given: xxxx-xxxx-xxxx-xxxx where x is a single digit.

Tricky tricky… there was a hint pointing us to 

, but is that challenge even human-solvable?

We also asked you to produce a qualified write-up report explaining the logic allowing such exploitation. This write-up serves two purposes:

Determine the contestant ability to properly describe a vulnerability and its vectors inside a professionally redacted report. This capacity gives us invaluable hints on your own, unique, talent as a bug hunter.

solve the challenge without the use of any tool

The second valid report is a piece of mastery crafted by 

We were absolutely thrilled by the quality of this session’s reports.

During the testing, I found that we need to find seven valid serials for the provided XPATH query. The format of a serial is defined as: 0000-0000-0000-0000. There are filters applied on the provided serial:

A serial can only contain 0-9 numbers and ‘-‘ character. If any other character is provided, then it will be replaced by ‘0’

I solved this challenge by writing a constraint solver using Z3 theorem prover tool.

 The code is obfuscated and unreadable for me. So I took apart the query in different portions. This way I could easily read the XPATH query and understand it. See below:

 Now, I tried to solve the equations that do not contain the $serial value, by passing the XPATH query in template parameter to endpoint /backend/xpath as shown in the image below:

 Thus, I have solved all the possible equations and put it in the image shown in Step 1 above. It now goes like this:

So, we have minified the XPATH query. Please note the lines 21 and 23 in the image in Step 3:

The line 21 with value 1 is the second argument of first substring function which indicates the starting index of string.

The line 23 indicates the length of that string which is 15.

As we can see, the length of “Access granted!” is same as the length of “Access refused!”, and both equal to 15.

 Now, note the second substring function which takes the output of translate()*42 as its second argument and 15 as third argument. We can thus understand that, if we want to get the “Access granted!” string, then the output of translate()*42 should not be greater than 15.

. substring("abcdefghijklmno", 16 ,15) will output nothing as second argument (

starting of the string) as it is greater than the length of the string.

 Another thing to observe is the arguments of the translate function. We can think of translate as a replace function which does not follow any order.

 translate('abc', 'cb', 'YX') will output aXY 

 ‘c’ is replaced by ‘Y’ and ‘b’ is replaced by ‘X’, although they were in different order.

In our minified XPATH query, we could see the second argument of translate function is uareltsf and the third argument is 01001011. And the conditions (

) from line 3 to 17 eithers outputs true or false. So, this means true will be replaced by 0000 and false will be replaced by 11110.

To fufill the condition in Step 5 above, we need all the values equal to true since after concatenation it will output truetruetrue.... which will be replaced 0000000000.... and Access granted! will be printed out.

However, to realise those conditions, we need to write a constraint solver. I wrote a small script using Z3 to solve it. I have also added comments in the code to make it more self-explanatory.

Requirements: Follow the instructions here:

Run the provided solution script using python: python sol.py

I found the following 7 valid serial keys:

BONUS: MARCOSEN manual solve (well, if brain had fingers)

The problem here is, that only some obfuscated code is used to hide the evaluation of the serial.

The first part was to remove all the “static garbage” from the code. This means to evaluate all the terms that do not contain the serial. I did this by just sending the term I wanted to evaluate and checking the servers answer.

The next step was to replace all the substring-methods just to make it obvious which part of the serial should be evaluate in that part of the code. I replaced it in the code-snippet below with partX.

Looking at the substring with “granted”, we can observe that the translate-method must be 0, so that we get the substring of the beginning of “granted”. These leaves us with the information that the concatenation of the inner terms must be as follows:

For the math, I will replace part1-part4 with a-d. Simplifying the terms gives us seven equations:

Time to solve the equations! I started by just making it all depending on c. This gives us:

Ok, so c = ? How do we get the value of c? We know that c must be dividable by 9. It must also be dividable by 4, because b = c/4. Also b must be dividable by 5. So, we need the least common multiple (LCM) of 5, 9 and 4. This gives us that c must be a multiple of 180. So, for the next steps I will express this with c = 180x.

But that’s not the end of it. The next step was the hardest for me. It’s the step to get the equation for d to be true. By using the multiplicative inverse modulo of 8 we can get the correct values for c:

This gives us the values of x and therefore the seven values for c = 180x. With the equations above the input strings for the admin access are:

 is the Technical Ambassador at Yes We Hack. He also created the DOJO and this challenge.

While Z3 was not required to solve this challenge, it is a nice simple exercice to get started with the library. Z3 or other SMT solver can be really useful when dealing with a large number of constraints.

DOJO CHALLENGE #4 Winners!

Every business needs a vulnerability disclosure policy. Thankfully, a growing number of organisations have one. Yet, those programs are not always a click away. Here’s to a unique plugin for both Chrome and Firefox, because making it easy to report issues need not be much work.

We are all too familiar with the quotidian data breach debacle that organisations go through more often than not. Besides, the initial notice frequently comes from an “anonymous report” or a disgruntled ethical hacker tweeting about your mishandling their repeated vulnerability notifications.

Those are situations we observe, yet many still struggle with preparing for them and the PR mess that inevitably follows. Shooting the messager, coming up with statements that look pretty much like they have been 

 for months, are all symptoms that you are ill-prepared to handle reports from the broader security community.

One robust approach to preventing stinky headlines and loss of trust from customers and partners is a vulnerability disclosure policy (VDP). That policy is a commitment that your organisation will receive, evaluate, and if need be, fix vulnerabilities notified by security folks external to the business.
A VDP also clarifies that you will not go after ethical hackers willing to help you improve the security of your service or product.

For a VDP to be efficient, it needs a few essential elements:

 clearly state what is what, identifying assets that your VDP covers.

 specifically directed at ethical hackers, this bit confirms your commitment to not prosecuting well-intentioned researchers who report a vulnerability. That part is particularly important as legal clarity across organisations and countries is extremely challenging to achieve.

: the precise mechanism your organisation has set up and, ideally, the details you would want to see added to a vulnerability report. The aim here is to make said report the most useful possible to the organisation’s technical team.

: anything you find relevant to smoothen communication.

You get it right: setting up such a policy implies you have thought out roles and responsibilities internally. Rather than a burden, setting a VDP and organising it is a way of developing talent, breaking silos and improving security altogether.

The better news: Showcasing your VDP has never been easier

You have a VDP; you need to feature it prominently on the organisation’s website so it is accessible to anyone who needs it. One way of doing so is creating a dedicated webpage, 

Another way is thanks to a simple tool that comes in handy, namely 

. You fill in the form, download the file and upload it to the business’s website. Your security.txt can contain 

. Indeed, a Bug Bounty programme is a vulnerability disclosure policy with a monetary reward system.

Whichever way you choose, you will want it to be known. Well, now, 

 . Whenever you browse the web, the plugin indicates whether a VDP exists. Because making it easy to report issues does not need to be much work!

Wanna go for a cool – and secure – carpooling service?


We have marked cases where a VDP exists without a security.txt as “room for improvement” to highlight that security.txt is a (draft, for now) standard. As such, it makes locating a VDP policy even easier since one needs no extra browsing to find the contact detail: the security.txt file is always present at www.mywebsite.tld/.well-known/security.txt

Showcasing your vulnerability disclosure policy to the world

Interview with Romain Lods, Head of Engineering,

Why did you decide to launch a Bug Bounty program?

About two years before we launched our Bug Bounty program, we started internal security audits on our code, which had never been done before at Deezer. These tests allowed us to make a first pass and fix some obvious vulnerabilities.

Then we became interested in Bug Bounty and 

The ease of use of the platform convinced us of launching a program.

 Following the launch, we very quickly received interesting vulnerabilities, everything went smoothly, so we decided to conti­nue and expand our perimeters.

What value does Bug Bounty offer compared to traditional cyber security solutions, such as penetration testing?

We typically perform an annual audit on several of our services, which lasts between one and three weeks. But this approach is expensive, focuses only on a few services, and over time, doesn’t really deliver interesting results. Bug Bounty gives us ongoing feedback throughout the year, on various scopes, and detects bugs very quickly.

In terms of ROI, Bug Bounty is also very interesting: we decide ourselves the reward we assign to each vulnerability.

Moreover, Bug Bounty guarantees us a diversity of testing skills. With penetration testing, each consul­tant is ultra-specialized, so we tend to guide him or her on what we want from the test.

With Bug Bounty, we were surprised by some researchers’ reports. They gave us results of original scenarios, which we had never seen before.

Finally, I appreciate the quality of the reports on the flaws reported through YesWeHack. You sense the researchers are really trying to offer a functional and reproducible POC, that we can easily retest.

The reports of our usual audits are generally quite accurate, 

but we also find the equivalent quality with Bug Bounty, when the researchers are good and ‘play the game’

. It’s very pleasant to receive reports illustrated with screenshots and videos, which greatly facilitates their understanding, validation, and also their communication to the teams concerned.

Check out Deezer’s public Bug Bounty program

Do you get help from researchers to analyze and fix the bugs received?

Yes, the researchers help us in the bug reproduction phase. In some cases, we ask them to check whether the vulnerability has been fixed. We also have a large team of developers in-house who can take care of this patch management.

Does Bug Bounty mean the end of penetration testing or are the two complementary?

For me the two remain absolutely complementary. 

Bug Bounty is a tool that goes further and deeper than the audit.

 We use penetration testing on new services, or on scopes where we already know there are problems.

Have you observed any changes in your teams since you began using Bug Bounty?

We clearly see an increased awareness of security. Bug Bounty reports helped us trigger some major security projects. 

Our cybersecurity vision and posture have evolved, and Bug Bounty is one of the drivers of this change

In terms of organization, we adapted our process to collect, sort, and validate reports. Then, based on the elements of each validated report, an internal ticket is created and assigned to the relevant team for processing with a varying degree of priority.

Do you consider Bug Bounty as a sign of confidence towards the market?

Using a public Bug Bounty program, we can demonstrate and highlight our concerns about security and transparency

. We also assume the fact of exposing ourselves to ‘controlled’ attacks, and to consider the valuable feedback from the researchers’ community.

At Deezer, we also have a team dedicated to fraud: indeed, artists and labels are paid according to the audience of the tracks. In order to guarantee their income, we have to protect them from any fraud relating to the platform. So, this is a crucial part of our cybersecurity strategy – and within the scope of our Bug Bounty program.

For the time being, we are pursuing our current strategy, regularly reviving the program when activity is declining. Generally speaking, the amount of feedback often depends on how visible Deezer is in the news. When we communicate more or launch campaigns, researchers are attracted to our program.

As a next step, we will consider an increase in bounties to encourage researchers to find more complex vulnerabilities.

Do you have any advice for CISOs or startups considering Bug Bounty?

As a general rule, it’s better to know your security flaws when you start a project, rather than wait until there are too many to deal with, after you’ve made (bad) choices of architectures.

When I see what our Bug Bounty program brought us, I think it would have been better if we had taken these insights into account as early as possible.

So, I would recommend not waiting too long to implement tools such as Bug Bounty

, in order to minimize the dependency on legacy systems, which are more complex to secure afterward.

If you want more information about Bug Bounty & YesWeHack,

Founded in 2013, YesWeHack is the #1 European Bug Bounty & VDP Platform.

YesWeHack offers companies an innovative approach to cybersecurity with Bug Bounty (pay-per-vulnerability discovered), connecting tens of thousands cyber-security experts (ethical hackers) across 120 countries with organisations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices.

YesWeHack runs private (invitation based only) programs, public programs and vulnerability disclosure policies (VDP) for hundreds of organisations worldwide in compliance with the strictest European regulations.

Deezer protects their artists & users with a public Bug Bounty program

Alain Tiemblo, Web Security Lead Engineer,

We used to rely on ‘traditional’ audits, such as vulnerability scans, penetration testing, and code analysis, which exposed a lot of threats. Then, we began receiving messages from trolls on social networks, reporting potential vulnerabilities, without notice and without any detail.

We also received emails via customer support regarding vulnerabilities, with no precise or exploitable information. These people wanted payment before revealing more information, but in the absence of any ‘proven’ flaw, it was impossible for us to pay them.

The volume of these messages grew and grew, up to the point where we decided to take the Bug Bounty step, in order to channel this flow of noisy reports.

We compared different Bug Bounty platforms in Europe and 

mainly for regulatory and data sovereignty reasons.

was the number of active hunters on the platform

: it doesn’t make much sense to put money and energy into a Bug Bounty program if there isn’t a sufficient number of hunters to effectively search for vulne­rabilities.

Conversely, we integrated security.txt on our web­site to guide hunters to the YesWeHack platform, as Bug Bounty is a good way to encourage Coordinated Vulnerabilities Disclosure.

Can you describe the evolution of your program from the beginning?

We launched our private program in late 2017, with an important running-in phase. When we opened, we initially received many reports, then we gradually refined our program. For example, we defined our scopes more clearly, including the type of vulnerabilities we wanted to see reported.

From the outset, we received ‘real’ and potential critical vulnerabilities, which convinced us of the relevance of the model and the effectiveness of the platform.

After one week, the number of reports began to decrease, but the ones that came up were more and more interesting. This is because the hunters ‘got into’ our product and produced reports that were really specific to our business.

After the first month, it became quieter, so we invited new hunters onto the program to introduce fresh eyes and other skills on specific aspects of our program.

The private program also allowed our teams to learn how to manage reports, classify and qualify them, and adjust the program rules.

Seven months after launching the private program, we switched to a public program. 

We were very satisfied with the quality of the interactions with the hunters during the private phase, and were therefore not worried about this transition… We just wanted more hunters on our program!

We also wanted to send a strong message to the community: anyone who finds a flaw can bring it back to us! Of course, we received more reports after the switch to a public program, but it was totally manageable.

Today, we are striving for quality reports on increasingly complex vulnerabilities that require more operating time for hunters, and more experienced hunter profiles.

In this context, we have increased the value of our rewards for critical and high vulnerabilities. The challenge is, with the support of YesWeHack, to attract researchers who find great stuff without ‘ex­ploding’ our rewards budget.

What value does Bug Bounty offer compared with traditional cybersecurity solutions, such as penetration testing?

The advantage of Bug Bounty is first of all crowdsourcing

The YesWeHack Blog

YesWeHackEDU: Addressing talent shortage through Bug Bounty

How Outscale secures its sovereign cloud with YesWeHack

DOJO CHALLENGE #4 Winners!

YesWeHackEDU: Addressing talent shortage through Bug Bounty

Showcasing your vulnerability disclosure policy to the world

Deezer protects their artists & users with a public Bug Bounty program

BlaBlaCar leverages crowdsourced security to secure its millions of users’ data

Showcasing your vulnerability disclosure policy to the world

YESWEHACK PROPHILE ON EBODA

Bug Bounty’s strengths compared to penetration testing

Fighting malware at the roots

YESWEHACK PROPHILE ON EBODA

Don't wait for threats to strike

Products

Researchers

Resources

Company

Follow us