Understanding the Heterogeneity of Contributors in Bug Bounty Programs

Abstract

Background: While bug bounty programs are not new in software development, an increasing number of companies, as well as open source projects, rely on external parties to perform the security assessment of their software for reward. However, there is relatively little empirical knowledge about the characteristics of bug bounty program contributors. Aim: This paper aims to understand those contributors by highlighting the heterogeneity among them. Method: We analyzed the histories of 82 bug bounty programs and 2,504 distinct bug bounty contributors, and conducted a quantitative and qualitative survey. Results: We found that there are project-specific and non-specific contributors who have different motivations for contributing to the products and organizations. Conclusions: Our findings provide insights to make bug bounty programs better and for further studies of new software development roles.

Proposal of a Novel Bug Bounty Implementation Using Gamification

“…The insufficient report quality is a casualty of first-come firstserved response to verified submissions, with hackers sometimes racing to submit a vulnerability. With many hackers concentrating on capitalising from their skills economically, many look to maximise the number of submissions rather than focusing on specific vulnerabilities (Hata et al, 2017). Potentially, this issue is encouraged with admission to private programs.…”

“…Without greater incentivisation to outweigh the decreased probability to discover bugs, there is a potential problem with incomplete coverage possibly leading to a false perception of security. The heterogeneity of hacker skillsets may mitigate this problem to some extent (Hata et al, 2017).…”

“…However, this process does introduce specific threats arising from the introduction of individuals upstream other than the vendor (Hata et al, 2017).…”

“…Bug bounty participants are heterogeneous, with the majority never achieving a successful submission (Hata et al, 2017). However, in the proposed method, these less successful participants can still contribute to the program through the verification process.…”

Toward Sustainable Communities with a Community Currency – A Study in Car Sharing

“…A number of companies and FLOSS projects rely on external parties to perform the security assessment of their software for reward called bug bounty program. It is reported that there are non-project-specific bug bounty hunters and they are different from traditional contributors who work on specific projects [10]. Nakasai et al studied the impact of budges donors will get and reported that monetary contributions have impact on software development processes [11].…”