Inside the GitLab public bug bounty program

This post details the launch and early success of GitLab's public bug bounty program, highlighting its role as a reactive security measure. It outlines key metrics for measuring success, including the quantity of new report submissions, the percentage of repeat reporters, transparency in vulnerability disclosure (setting all vulnerability details to public 30 days after a patch is released), responsiveness to reporters, and the commitment to competitive rewards. It also lists the top five GitLab reporters by bounty and mentions the desire to put GitLab Tanuki on swag.