The question still persists whether you should go for public programs or private programs.
No matter how you choose the structure, the bug bounty program, it can be entirely private, blatantly
public or anywhere between now.
I would like to tell you the main difference between these two programs.
Private programs are known only to those hackers that companies choose to invite based on their skills,
experience, location or other attributes.
But every report, participant, bounty and other aspect of this program is totally private.
For example, let us take the example of Amazon now.
Amazon is searching freelance hackers, which are not the employees and who have a great amount of experience
in the bounty programs.
They have exceptional ethical hacking skills, which you will also be learning in the schools, and
they are available for the period, according to Amazon.
So Amazon does is the invite a group of, let's say, five hackers into the company and tell them to
test this software or this service and then, if possible, report a successful vulnerability in such
case?
Amazon has invited these five people based on their skills, location and experience.
And then all the details of this bug bounty program, including what to find, how to find methodology,
rewards, etc., is hidden from the outside world.
This is an example of a private bug bounty program, not public, but bounty programs are open to all
hackers and can maximize both the program's visibility and the volume of participants and their varying
skills.
For example, let us take the example of Google.
Now, Google has made an update to Jimmy Andalus, publicly known.
So what is Google sees is this big bounty program is available to everyone and we want hackers to hack
and find the vulnerabilities if exist and just let us know the vulnerability report we will award them.
In this case, Google is allowing all the entire hacker community to test their applications and report
the vulnerability.
The public bug bounty programs give you a better coverage and exposure to hackers and can also be publicized
to show your customers how much effort you're putting into security.
This was quoted by Hacker one, which is the top platform for bug bounty hunters, and I was discussing
Hacker one in upcoming lecture.
But even public programs are customizable.
Bug reports can remain private and redacted, then awards can be disclosed and vulnerability can be
disclosed.
Private bug bounty programs currently make up to 79 percent of all the bounty programs on Hakka one.
You can see more statistics and analysis on the website and you might now have a question, what is
Håkon?
Well, in the next lecture we will be discussing about HACA one and we will also see a fully managed
Hakka bug bounty program.