TechPrufer
Get started
Slack
Slack logoSlack · Feature trail

Bug Bounty Program Evolution

1 post · Mar 2017

What this trail covers

This thread tracks the evolution of Slack's Bug Bounty program, focusing on its growth, operational improvements, and the technical aspects of security research. Initial posts detailed the program's launch and basic operational flow. This post provides a three-year retrospective, highlighting key metrics such as the number of reports, response times, and bounty payouts. It discusses lessons learned regarding program management, the importance of a triage service, and maintaining researcher and internal developer happiness. The post also offers guidance to security researchers on areas of interest within Slack's various components (API, web app, desktop, mobile, websockets) and common vulnerability types.

All Slack trails
  1. Slack Bug Bounty: Three Years LaterThis post details the three-year evolution of Slack's Bug Bounty program. It presents metrics on incoming reports, mean response time (showing improvement after implementing a triage service), and total bounties awarded. Key lessons learned include the importance of preparing for an initial influx of reports, the value of a third-party triage service for managing volume and allowing the security team to focus on resolution, and the need to balance researcher and internal developer happiness through timely communication and bug severity classification. It also provides a technical breakdown of areas of interest for researchers within Slack's API, web app, desktop app, mobile apps, and WebSocket endpoints, along with common vulnerability types for each.