Working with the Security Researcher Community
Taking care of the relationship with those who report vulnerabilities
The community of independent researchers who take part in bug bounty programs is driven largely by reputation and fair treatment, not just money, and an organization that ignores that dynamic loses access to the best talent over time. Taking care of this relationship means publicly recognizing researchers who contribute valid findings, through a hall of fame or specific mentions, responding respectfully even when a report turns out to be a false positive, and avoiding legal threats against researchers who acted within the program's rules, a mistake that has seriously damaged the reputation of several well-known companies in the past. In practice, a researcher who had a bad experience with a program not only stops reporting there, but shares that experience with other researchers, reducing future interest in participating. Treating the community as a long-term partner, instead of a free supplier of findings, is what sustains a healthy bug bounty program.