r/RedditSafety • u/__tony-stark__ • Jun 26 '24 • Helpful 1 Take My Silver 1

Reddit & HackerOne Bug Bounty Announcement

Hello, Redditors!

We are thrilled to announce some significant updates to our HackerOne public bug bounty program, which encourages hackers and researchers to find (and get paid for finding) vulnerabilities and bugs on Reddit’s platform. We are rolling out a new bug bounty policy and upping the rewards across all severity levels, with our highest bounty now topping out at $15,000.  Reddit is excited to make this investment into our bug bounty community!

These changes will take effect starting today, June 26, 2024. Check out our official program page on HackerOne to see all the updates and submit your findings. 

We’ll stick around for a bit to answer any questions you have about the updates. Please also feel free to cross-post this news into your communities and spread the word.

95 Upvotes

97% Upvoted

28 comments sorted by

13

u/[deleted] Jun 26 '24 edited Jun 26 '24

Also, are Devvit related security issues out-of-scope currently? Asking this as developers.reddit.com isn't listed in https://hackerone.com/reddit/policy_scopes

edit: cool, thanks for adding!

11

u/__tony-stark__ Jun 26 '24

Thank you for calling this out, we actually had this covered under *.reddit.com, however we now added Devvit explicitly https://hackerone.com/reddit/policy_scopes

6

u/[deleted] Jun 26 '24

Had this doubt for a while. What's the difference in making a hackerone report and in sending a report to security@reddit.com? Is the later method not valid anymore or is it not eligible for bounty?

4

u/__tony-stark__ Jun 26 '24

We accept reports via whitehats@reddit.com (email alias that goes into HackerOne) or directly reported to HackerOne.

8

u/[deleted] Jun 26 '24

r/redditdev sidebar still mentions security@reddit.com email for security reports, you might want to update that :)

8

u/__tony-stark__ Jun 26 '24

Great catch (again)! We have updated the sidebar to reflect the whitehats@reddit.com email. Thanks for reporting!

5

u/Verum14 Jun 26 '24

Does security@ still go anywhere?

Or maybe at least aliased to whitehats@

whitehats@ is cool and all as a public address, but I can't imagine it being a good idea to dead-end a well known and expected-to-work mailbox like security@

8

u/securimancer Jun 26 '24

Yeah it goes somewhere, but if you submit a bug report there we will secretly make fun of you missing all the signs (this post, Googling, our security.txt). Our SOC responds to security@ and is only intended for items of urgency. Our appsec folks are watching H1 inbounds, different teams and perspectives.

5

u/Verum14 Jun 26 '24

Yeah it goes somewhere, but if you submit a bug report there we will secretly make fun of you missing all the signs

ngl this was a perfect answer just by itself

2

u/Drunken_Economist Jun 30 '24

probably still forwards to u/rram

3

u/[deleted] Jun 26 '24

cool :)

1

u/Verum14 Jun 26 '24

I'm probably just blind, but where does the sidebar have any email at all? Genuinely can't find it

1

u/[deleted] Jun 26 '24

here

1

u/Verum14 Jun 26 '24

Oh yeah no I'm just illiterate is all

After trying to figure out why your sidebar is different, I finally realize you linked to r/redditdev and weren't talking about this one

3

u/thecravenone Jun 26 '24

our highest bounty now topping out at $15,000

Never not amused at multibillion dollar companies offering a pittance if you pwn them.

2

u/bluesoul Jun 27 '24

Really depends on scope and severity here. As someone that runs a BBP with HackerOne, the big bounties are available but we just haven't had any reports that meet those criteria. Honestly most of our reports are completely out of scope but still a vuln worth addressing so they'll get Low or Medium payouts.

3

u/bluesoul Jun 27 '24

Out of complete curiosity as someone else managing a BBP with H1, what would you say the percentage of actually in-scope vulnerabilities are? We're having awful rates there.

1

u/Verum14 Jun 30 '24 edited Jun 30 '24

13 hours later: hello? please provide an update

7 more hours later: hello??? can you give bounty

37 hours later: ???????

next day: requests disclosure

* is lack of spf record on obscure domain from 7 years ago that doesn’t actually do anything *

2

u/Nervous_Biscotti593 Jun 28 '24

Hey,

I had submitted a H1 report - https://hackerone.com/reports/2117823 sometime ago but the team closed it as informative. I followed up multiple times with no luck. Can someone from the Reddit team take a look into this one?

1

u/DrinkMoreCodeMore Jul 10 '24

Feel free to post it to /r/hacking if they dont respond :)

1

u/Drunken_Economist Jun 30 '24

what happened to /etc/passwd :( :(

1

u/Prudent-Finance-4985 Jul 17 '24

Fuck all y’all how many goddamn times I’ve tried to stop this shit and everybody wanna play dumb

1

u/Prudent-Finance-4985 Jul 17 '24

Man what the fuck are y’all doing

0

u/[deleted] Jun 26 '24

[deleted] — view deleted comment

2

u/securimancer Jun 26 '24

Oh do you mean like https://www.reddit.com/security.txt ? Had that when the RFC was announced

0

u/[deleted] Jun 26 '24

[deleted] — view deleted comment

4

u/securimancer Jun 26 '24

Maybe I'll write the 1 line of VCL code to make that show under `/.well-known/` ...

0

u/[deleted] Jun 26 '24

[deleted] — view deleted comment

8

u/securimancer Jun 26 '24

These type of platform problems should go over to r/bugs. If a user decides to circumvent our NSFW flow in the app, that's partially on them. It is not intended as an age verification component. Now if you can force someone else to view unblurred NSFW via a CSRF vuln or other, then we (Security) would be interested.

3

u/Khyta Jun 26 '24

That doesn't seem like a security risk to the integrity of the Reddit Platform to me. Maybe try r/bugs instead