LinkedIn plans to continue closely vetting researchers for its bug bounty rewards program, saying it reduces the number of distracting erroneous and irrelevant reports.
The decision to keep its program private “gives our strong internal application security team the ability to focus on securing the next generation of LinkedIn’s products while interacting with a small, qualified community of external researchers,” wrote Cory Scott, LinkedIn’s director of information security, in a blog post.
Security researchers with vetted backgrounds are invited to participate, which allow them to have the same experience as if they were on LinkedIn’s internal security team, Scott wrote.
Many large technology companies such as Google, Yahoo and Facebook have public bug bounty programs, which pay rewards for valid security vulnerabilities usually based on their severity.
Scott wrote that the vast majority of bugs reported to LinkedIn from the general public “were not actionable or meaningful.” The private program, launched last October, “has a signal-to-noise ratio of 7:3, which significantly exceeds the public ratios of popular public bug bounty programs.”
The professional networking site will still review bugs submitted through its catch-all security email address, security@linkedin.com, he wrote.
LinkedIn uses HackerOne for its bug program, which is a company that has a secure platform that manages security vulnerability information and handles disclosure information and rewards. LinkedIn has paid out US$65,000 since the program launched, Scott wrote.