Heroku Security Bug Bounty

Heroku Security Bug Bounty(blog.heroku.com)

46 points by leahculver 12 years ago | 6 comments

daeken 12 years ago |

> As part of Heroku and our parent company Salesforce.com’s commitment to philanthropy, if you are interested in donating your bounty to a recognized charity we will match it dollar-for-dollar.

Kudos to the Heroku folks for this. I haven't seen any other bug bounty program doing this (I'd love to be wrong -- please let me know if I am!), and it's a very nice change from the norm.

jon-wood 12 years ago | |

Google also match anyone who donates their bounty to charity.

badhairday 12 years ago | |

Yes! Reading that part put a smile on my face.

oijaf888 12 years ago |

I wonder why they chose BugCrowd over the seemingly significantly cheaper HackerOne?

infosectosser 12 years ago | |

I would guess it is precisely because BugCrowd is more expensive. They offer a managed program where BugCrowd's employees validate bug reports for participating companies. Speaking from experience, that process can become very time-consuming.

EricDeb 12 years ago | | |

If I were running a startup or even a moderately-sized company, implementing and managing a bug bounty program internally sounds like a headache, and probably would be put off indefinitely. A managed solution like BugCrowd could definitely fill this void.