AppSec USA 2016 has ended
Back To Schedule
Thursday, October 13 • 9:30am - 11:30am
OWASP Bug Bounty for projects

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

In June 2016, we started the OWASP Bug Bounty for projects initiative, where security researchers can actually submit their findings on the participant OWASP projects through the BugCrowd platform. 

Many developers and companies looking to implement security are turning towards OWASP to use Defender libraries that they can implement to secure their critical applications. Since this implies a form of trust in OWASP, many users of these projects might forget or not be aware that many of them are Open Source and lack an expected security assurance review, which at the moment is not done by OWASP.

Testing web applications for security can be a challenging task. But testing that security control libraries are robust in the face of attack is an even more difficult challenge for even the most sophistical assessment professionals. 

BugCrowd provides their platform and services to allow OWASP projects conduct specific Bug Bounty programs for Defender category projects but also, any other Code Project that needs to be installed and could create vulnerabilities in the installed computer.

The following projects are part of OWASP Bug Bounty:

We want to promote and spread the word regarding our Bug Bounty program. The activity we want to plan during the APPSEC US 2016, involves an OWASP Bug Bash similar to the one organised in APPSEC  2013 but only with OWASP projects part of the Bounty program, where we provide a deployed server with the applications.

Thursday October 13, 2016 9:30am - 11:30am EDT
Meeting Room 2