HackerOne has fired an employee for using bug reports submitted by external researchers to claim extra bounties elsewhere.<\/p>\n
The company was compelled to investigate the issue after a customer filed a complaint on June 22 asking it to investigate “a suspicious vulnerability disclosure made outside of the HackerOne platform.”<\/p>\n
According to HackerOne co-founder and CISO Chris Evans, the now-former employee’s role was to triage bugs for numerous customer bounty programs.<\/p>\n
He said the former employee illegally accessed security reports sometime between April 4 and June 22 and then leaked the information outside the HackerOne platform to claim additional bounties elsewhere.<\/p>\n
“This is a clear violation of our values, our culture, our policies and our employment contracts. In under 24 hours, we worked quickly to contain the incident by identifying the then-employee and cutting off access to data. We have since terminated the employee and further bolstered our defenses to avoid similar situations in the future,” Evans said.<\/p>\n
HackerOne, the largest bug bounty platform, receives bug reports from ethical hackers about software and analyzes the reports internally to determine whether rewards should be paid to those who reported them.<\/p>\n