Slack Bug Bounty: Three Years Later

This post details the three-year evolution of Slack's Bug Bounty program. It presents metrics on incoming reports, mean response time (showing improvement after implementing a triage service), and total bounties awarded. Key lessons learned include the importance of preparing for an initial influx of reports, the value of a third-party triage service for managing volume and allowing the security team to focus on resolution, and the need to balance researcher and internal developer happiness through timely communication and bug severity classification. It also provides a technical breakdown of areas of interest for researchers within Slack's API, web app, desktop app, mobile apps, and WebSocket endpoints, along with common vulnerability types for each.