BALANCING SECRECY AND TRANSPARENCY IN BUG BOUNTY PROGRAMS

Summary from the TLDR InfoSec newsletter

Bug bounty programs allow vendors to expand their security testing efforts with community hackers who can receive payment for their work. One issue with this approach is that, particularly in private programs, vendors control the disclosure timeline and may create an information gap. Government organizations should step in to regulate vulnerability disclosure with NIST drafting standards and metrics for bug bounty programs, CISA establishing a voluntary vendor accreditation program, as well as requiring federal agencies to comply with the standards, and the SEC to require publicly traded companies to report their bug bounty metrics.