How to Find Bug Bounty and Disclosure Programs and Get a Report Accepted

·1 views

A guide explains where to find vulnerability disclosure and bug bounty programs and how to approach them responsibly. It distinguishes vulnerability disclosure programs, which set out how to report security flaws and typically offer recognition, from bug bounties, which additionally pay rewards. The guide stresses reading each program's scope and policy before testing, since published scope and safe-harbour clauses define what the owner accepts. It notes that a US Justice Department charging policy favours prosecutors declining cases involving good-faith security research, but that this does not create enforceable rights or cover civil claims or other countries. Major platforms such as HackerOne, Bugcrowd, Intigriti, and YesWeHack publish program directories, though private invite-only programs are not listed publicly.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Mori Period App Recomputes Predictions Instead of Storing Them

The developer of Mori, an offline period tracker with no account, explains why the app does not save its predicted dates in a database. Stored predictions go stale when past entries are corrected, can create mismatches between screens, and add extra data that must be deleted. Instead, the app stores only the dates users mark and recalculates predictions from that history using an explicit as-of date. The developer notes this makes results reproducible and simplifies deletion, at the cost of recomputing on each read. The phone is the only copy of user data by default, so keeping a single source of truth is treated as important.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Study finds no detectable effect of a book launch on AI search citations

A researcher tracked how answer engines with web search responded to 16 fixed questions about a new author, scoring answers on a fixed scale. After the author's first novel was released on 8 October 2026, the study compared a drift-adjusted baseline with the following month. The headline score rose by 1.38 percentage points, but the 95% interval (-3.59 to 6.68) includes zero, so the pre-registered null hypothesis was not rejected. Neither the direct-answer nor the recommendation channel showed a meaningful shift, and the predicted earlier pickup in direct answers was not supported. The author notes limitations including a single-author design with no comparison group, incomplete Gemini data, and possible unrelated changes to provider search systems during the same period.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Valve améliore la qualité du streaming SteamVR, un enjeu notable pour les personnes amblyopes

Valve a publié une mise à jour bêta de SteamVR qui améliore la netteté, la stabilité et la fidélité de l'image en streaming sur les casques autonomes compatibles Steam Link, dont Meta Quest, HTC Vive Focus et PICO. Pour la plupart des utilisateurs, il s'agit surtout d'un gain de confort visuel. Le texte souligne qu'une qualité d'affichage stable est essentielle pour les personnes atteintes d'amblyopie, car elle conditionne l'efficacité des exercices d'entraînement binoculaire. L'article présente aussi Amblyotube, une application Meta Quest de rééducation visuelle développée par Seven Sports, qui envoie deux flux visuels distincts à chaque œil pendant la lecture de contenus vidéo. L'éditeur précise qu'il s'agit d'un outil complémentaire, recommandé dès 13 ans à raison de 30 à 40 minutes par jour, et non d'un traitement médical.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Bounded Replay for Realtime Voice Lobbies: Recovering Go Clients Without Duplicates

The article argues that offline replay should be treated as a bounded recovery mode rather than a second live session in realtime gaming voice lobbies. It recommends a stable channel identifier and explicit client-server ownership so reconnects do not cause duplicate joins, phantom speakers, or audit gaps. Monitoring should track authentication, subscription, and business events as separate streams that share a correlation ID but not a success counter. On reconnect, a client compares its last stable identifier with the server's authoritative snapshot, replaying only newer events or resubscribing cleanly if the identifier falls outside the retained window. Because transport may deliver at least once, operations such as joining or muting are made idempotent using client-generated operation IDs.

0 comments Read more at DEV Community