Ask HN: Should an early stage startup pay for a bug bounty platform (HackerOne)?
Our product stores personal information like bank account details and ID uploads so we're worried about an eventual data leak. While we think we're storing everything securely, a data leak would be disastrous given the kind of data we are storing.
We looked into a platform like HackerOne but were quoted 60-70K per year to run a bug bounty program. Since we're new and our profits are still small, our budget is closer to 10% of that.
What are our options for a security audit? Is this even something worth pursuing when we're still deciding whether we have product-market fit?
(
3 comments
| 2 points
| on HN
)
I know a startup listed there and they get regularly approached by security researchers. Some only run generic test suites, e.g. port scans, if signing up with unicode usernames causes errors, cross-side scripting, but it will still be valuable. And a cross-side scripting bug has bounties of 100 USD or less.
Via a recent Show HN submission I got a security scan by https://www.cybersenshi.com/ which I think was comprehensive.
I think it's better to make a 1 page to put details scope, rewards, etc. Here is good example https://bugbounty.linecorp.com/en/
And bounty platforms aren't a security audit. If you want an audit, buy an audit by someone who gets access to your code and can review your internal setup.