Announcing the public launch of Cloudflare's bug bounty program
Feb 1, 2022Rushil Shah
Summary
Cloudflare has launched a public bug bounty program, transitioning from a vulnerability disclosure policy and a private bounty program. This move aims to incentivize higher quality reports and deeper security research by offering cash bounties. The program has improved its signal-to-noise ratio to 68% through better documentation, a dedicated testing playground (CumulusFire), and a streamlined vulnerability management process with automated ticketing and SLA-driven remediation. The company has paid out over $211,512 in bounties through its private program and is now expanding to a public offering.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack