HackerOne goes all pro

Eligible open source projects will receive HackerOne's Professional service for free.

One of the original crowdsourced bug bounty programs is offering its services free to open source projects — as a way to contribute to the maintenance of the internet infrastructure we all rely on.

“Open source runs through our veins,” HackerOne spokeswoman Lauren Koszarek told CyberScoop by email. “We know that open source underpins many products and services that we use every day so we want to ensure that open source projects can get as much support as possible in running simple, efficient, and productive security programs.

“We want to give something back,” she said.

Outside of web-geek circles, few people realize the extent to which the internet is based on open source software that is often developed, maintained and updated by volunteers. OpenSSL, for instance, the open source cryptographic software library that was discovered to be vulnerable to the massive Heartbleed vulnerability, was maintained by three part-time volunteers. But when the Heartbleed coding error was discovered, it affected a majority of the internet’s websites.

Although OpenSSL got grants and other support following Heartbleed, many vital parts of the internet infrastructure continue to be maintained on a collaborative, voluntary basis through open source projects on which coders work together often in the their spare time.

“Eligible open source projects will receive the powerful HackerOne Professional service for free,” Explained Koszarek. To be eligible, projects must be available for wide use under an Open Source Initiative license; be active for at least three months; provide instructions for researchers to submit bug findings; advertise the HackerOne program; and respond to new vulnerability reports within a week.

For eligible projects, the company’s Community Edition platform will provide “vulnerability submission, coordination, dupe detection, analytics, and bounty programs,” and “greatly simplify how you define scope, receive vulnerability reports, manage those reports, and incentivize security researchers to help harden your project.”

HackerOne does not pay any bounties itself. It’s up to the companies using its system to decide how they want to reward the hackers who find bugs — with cash rewards or with kudos points, which raise the finders’ earning power across the entire HackerOne ecosystem. Likewise, it will be up to the open source projects who join the platform to decide what reward system to use.

Microsoft, tech companies throw weight behind spread of open-source AI

Other signatories of the letter include Meta, Palantir, Perplexity, Mistral, NVIDIA, Mozilla, The Linux Foundation, Hugging Face, Dell Technologies and IBM.

Found fast, fixed slow: The gap the AI clearinghouse must close

CISA chief frets about open-source vulnerabilities, delayed security improvements

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure