> If one doesn't want to use a platform like HackerOne you're in a tax hell doing payments to people all over the world
Why would the company paying be in tax hell? The recipient is the one who needs to pay income tax
Re:So I reverse engineered two dating apps
by DrRobinson on Sunday May 03, 2020 @04:32AM
(#23057721)
I actually don't know the exact details, I don't work with finance but that's one of the problems we identified when looking into it.
I think it has do do with how bug bounties generally work. Since bug hunters aren't sending an invoice from a registered company you have to pay employer tax or similar. But as I mentioned, I'm not entirely sure since I don't work with that part. It might also differ depending on where the company is registered.
* HackerOne is very expensive for most startups, IIRC it's around 30k USD/year only to be hosted on their platform (the price is probably different for different companies though.)
* If one doesn't want to use a platform like HackerOne you're in a tax hell doing payments to people all over the world
* The cost of paying for the bugs reported which can be massively expensive if you want to be competitive.
* The time it takes to handle all reports is massive. You might imagine you get cool and interesting research but 99.9% are people copy-pasting output from automated scanners, people reporting on out of scope things, usually low severity with things like "missing x-frame-options" or just straight up false positives. It's both frustrating, demotivating and time consuming.
I think a self hosted responsible disclosure program is better and more sustainable for most startups. Add a security.txt [0] to the website. You might still get a bunch of low quality reports but at least you give people a structured way of disclosing findings.
0. https://securitytxt.org/