Abstract The Internet of things (IoT) products, which have been widely adopted, still pose
challenges in the modern cybersecurity landscape. Many IoT devices are resource …

The task of identifying vulnerabilities is commonly outsourced to hackers participating in bug
bounty programs. As of July 2019, bug bounty platforms such as HackerOne have over 200 …

Although researchers have characterized the bug-bounty ecosystem from the point of view
of platforms and programs, minimal effort has been made to understand the perspectives of …

Vulnerability discovery is an essential aspect of software security. Currently, the demand for
security experts significantly exceeds the available vulnerability discovery workforce …

Vulnerability disclosure has been a controversial topic among scholars and practitioners.
Most scholars agree on adopting the responsible disclosure practices for vulnerability …

Vulnerability lifecycles and the vulnerability markets are related in a manner that can lead to
serious security and economic risks, especially regarding black markets. In the current era …

In this work, we considered two well-known bug bounty programs-HackerOne and Google
Vulnerability Research-with the goal of investigating patterns of activity and comparing …

Context: Coordination is a fundamental tenet of software engineering. Coordination is
required also for identifying discovered and disclosed software vulnerabilities with Common …

Cross-Site Scripting (XSS) is one of the most prevalent vulnerabilities on the Web. While
exploitation techniques are publicly documented, to date there is no study of how frequently …

This research is a case study on bug bounty hunting as a successful approach to finding and
uncovering vulnerabilities in software. The purpose of this study is to understand the …