Cloudflare opens $3,000 bug bounty program to the public

Cloudflare, a service provider of web infrastructure and security services, has announced the launch of its public bug bounty application.

Bug hunters and security scientists can now report vulnerabilities uncovered in Cloudflare goods as element of the company’s most current software, which is hosted on HackerOne.

A private bounty application was formerly released in 2018, next a vulnerability disclosure software in 2014. The company compensated $211,512 in bounties all through the life span of this method, with 292 out of the 430 studies receiving a reward.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

Rewards for Cloudflare’s most up-to-date software fluctuate with the severity of the vulnerability. Each and every security flaw is assigned a severity ranking based mostly on the Common Vulnerability Scoring Conventional (CVSS) edition 3.

There is a $3,000 payment for a critical vulnerability report, although superior, medium, and minimal vulnerabilities are well worth $1,000, $500, and $250, respectively. Nevertheless, rewards range for secondary and other targets.

As a way to make vulnerability investigate easier, Cloudflare also made a sandbox known as CumulusFire, which offers a standardized playground for scientists to examination their exploits. The sandbox will also guide Cloudflare’s security groups in reproducing potential exploits for evaluation.

“CumulusFire has previously aided us tackle the continual trickle of reports in which researchers would configure their origin server in an obviously insecure way, further than default or anticipated configurations, and then report that Cloudflare’s WAF does not block an attack. By coverage, we will now only take into account WAF bypasses a vulnerability if it is reproducible on CumulusFire,” described Cloudflare.

A great spot to commence is to refer to the documentation on Cloudflare’s developer and API portals, the Understanding Centre, and its help message boards.

The firm also aims to increase supplemental documentation, screening platforms, and a way for researchers to interact with its security teams to make certain submissions are legitimate.