Twitter 'Hacker One' Bounty Programme: Company pays $322,420 (Rs. 2.1 cr) bounty!

Twitter has paid out a bounty of $322,420 (Rs. 2.1 cr) in its ‘Hacker One’ programme. The social media giant has paid the hefty bounty to those who have been able to crack the vulnerabilities in the company’s website.

"We maintain a secure development lifecycle that includes secure development training to everyone that ships code, security review processes, hardened security libraries and robust testing through internal and external services - all to maximise the security we provide to our users," Arkadiy Tetelman, software engineer at Twitter, said in a blog post on Friday.

"We maintain a secure development lifecycle that includes secure development training to everyone that ships code, security review processes, hardened security libraries and robust testing through internal and external services - all to maximise the security we provide to our users," Arkadiy Tetelman, software engineer at Twitter, said in a blog post on Friday.

On top of these measures, the social media giant also engages the broader information security community through their bug bounty programme.

It was also aimed that security researchers come together to responsibly disclose vulnerabilities to the company so that they can respond and address these issues before they are exploited by others.

“The company has been utilising "HackerOne" since May 2014 and has found the program to be an invaluable resource for finding and fixing security vulnerabilities ranging from the mundane to severe”, Tetelman added.

The executive revealed that the company has received 5,171 submissions to the program from 1,662 researchers and 20 percent of resolved bugs were publicly disclosed (at the request of the researcher).

"We have paid out a total of $322,420 (USD) to researchers. Our average payout is $835. Our minimum payout is $140 and our highest payout to date was $12,040 (our payouts are always a multiple of 140)," Tetelman noted.

In the year 2015 alone, an individual researcher was able to bag over $54,000 (roughly Rs. 36 lakhs) for reporting vulnerabilities, the software engineer said.

"We also offer a minimum of $15,000 (roughly Rs. 10 lakhs) for remote code execution vulnerabilities, but we have yet to receive such a report," he added.