Open Bug Bounty community is growing: we have over 400 [fee free] bug bounty programs running now, and over 300,000 fixed security vulnerabilities. To facilitate further sustainable growth and to help website owners spot accidental exposure of personal data (PII) on their websites in a timely manner, we implemented a new type of non-intrusive submission – GDPR PII Exposure.
Here is how it works:
- Researches who find an unprotected document (e.g. PDF, MS Office document, HTML page, etc) with personal data (PII) can now report this to the website owner in a reliable and discreet manner.
- Website owners will be able to promptly remove or anonymize the data if the published PII is in a potential violation of GDPR requirements.
- Open Bug Bounty will not process or store any PII, and will only require anonymized sample of data for submission verification purposes.
Please carefully read the guidelines and make sure you will deliver value and support to the website owners when submitting such entries. Website owners are welcome to update their bug bounty programs, as usual and as always at no cost – we remain a free and non-profit project.
Among other upcoming improvements and updates:
- new badges for the best bloggers – you can share your researcher experience in our blog
- a free API for bug bounty owners (to quickly fetch vulnerabilities reported on their websites)
- a possibility to edit unapproved reports for security researchers
- our website speed tuning by adding new caching system
Thank you for your support and stay tuned!