Micro-blogging website Twitter has paid $322,420 (roughly Rs. 2.1 crores) to researchers and bug
hunters who, under its bug bounty "HackerOne" program, have disclosed
vulnerabilities in the last two years.
"We maintain a secure
development lifecycle that includes secure development training to
everyone that ships code, security review processes, hardened security
libraries and robust testing through internal and external services -
all to maximise the security we provide to our users," Arkadiy Tetelman,
software engineer at Twitter, said in a blog post on Friday.
On
top of these measures, the company also engages the broader information
security community through their bug bounty program, allowing security
researchers to responsibly disclose vulnerabilities to the company so
that they can can respond and address these issues before they are
exploited by others.
The company has been utilising "HackerOne"
since May 2014 and has found the program to be an invaluable resource
for finding and fixing security vulnerabilities ranging from the mundane
to severe, Tetelman added.
He noted that in two years, the
company has received 5,171 submissions to the program from 1,662
researchers and 20 percent of resolved bugs were publicly disclosed (at
the request of the researcher).
"We have paid out a total of
$322,420 (USD) to researchers. Our average payout is $835. Our minimum
payout is $140 and our highest payout to date was $12,040 (our payouts
are always a multiple of 140)," Tetelman noted.
In 2015 alone, a single researcher made over $54,000 (roughly Rs. 36 lakhs) for reporting vulnerabilities, the software engineer said.
"We
also offer a minimum of $15,000 (roughly Rs. 10 lakhs) for remote code execution
vulnerabilities, but we have yet to receive such a report," he added.
Tetelman
noted some great bugs exposed through the program, including XSS inside
Crashlytics Android app that renders part of its content inside a
webview, which did not have adequate protection against cross site
scripting attacks.
He also mentioned "IDOR allowing credit card
deletion" -- a simple insecure direct object reference bug on the credit
card deletion endpoint allowed an attacker to delete, but not view,
credit cards not belonging to them.
"If you are interested in
helping keep Twitter safe and secure too then head on over to our bug
bounty program, or apply to one of our open security positions!" he
said.
WazirX Hack: Crypto Exchange Contacts Projects Associated with Stolen Tokens in Ongoing Recovery Attempts24 July 2024
Search
![Gadgets 360 With Technical Guruji: News of the Week [March 29, 2025]](https://c.ndtvimg.com/2025-03/9cu1890s_news-of-the-week_160x120_29_March_25.jpg?downsize=180:*)
