LinkedIn bug bounty program goes public with rewards of up to $18k | The Daily Swig – PortSwigger

Adam Bannister 26 May 2022 at 15:26 UTC Social media platform ends private program after paying $250,000 in rewards over eight yearsLinkedIn has launched a public bug bounty program to replace the invite-only program that has been running since 2014.Critical security vulnerabilities discovered on the business-oriented social media platform will net researchers bounties ranging from $5,000 up to $15,000, while high severity issues will command rewards of between $2,500 and $5,000, and medium severity flaws will net bug hunters between $250 and $2,500.The program, which is hosted by HackerOne, invites hackers to probe the main web domain, LinkedIn.com, for security flaws, as well as the LinkedIn API plus Android and iOS mobile apps.Going publicIn scope on the Microsoft-owned platform are “implementation and design issues that substantially impact LinkedIn members’ data or LinkedIn infrastructure” such as cross-site scripting (XSS), cross-site request forgery (CSRF), SQL injection, authentication, access control, and server-side code execution vulnerabilities.“Our security team strives to provide a safe and secure experience for our 830 million members and customers by quickly addressing security vulnerabilities, constantly improving our defenses, and safeguarding our product development process,” said LinkedIn in a blog post announcing the news.Read more of the latest bug bounty newsThe…
Read More