Bugs, bounties, and cherry browns
Dec 12, 2019Juan Broullon

Summary
This post details the first year of GitLab's public bug bounty program, highlighting the number of reports received (1378 from 513 researchers), total bounties awarded ($565,650 to 171 researchers), and the impact on product security. It also announces winners of a bug bounty contest held in October-November, recognizing contributions for reputation points, best written report, most innovative report, and most impactful finding. The post also mentions custom swag for winners and a commitment to continued program improvement.
More from the Bug Triage and Reporting trail
- Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting
- Manage vulnerability noise at scale with auto-dismiss policies
- How to transform compliance observation management with GitLab
- Self-service security alert handling with GitLab's UAM
- How GitLab measures Red Team impact: The adoption rate metric