Don't waste your time and money on funding bug bounties or "getting audits done"... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		Rygian 16 days ago \| parent \| context \| favorite \| on: Unauthenticated remote code execution in OpenCode Don't waste your time and money on funding bug bounties or "getting audits done". Your staff will add another big security flaw just the next day, back to square one. Spend that money in reorganizing your management and training your staff so that everyone in your company is onboard with https://owasp.org/Top10/2025/A06_2025-Insecure_Design/ .

staticassertion 16 days ago | [–]

If part of the problem was that no one was responding to a vulnerability report then a bug bounty program would potentially address that.

liveoneggs 16 days ago | | [–]

you just get spammed with the same three fake reports over and over

staticassertion 16 days ago | | | [–]

Triage is something that these services provide, exactly to deal with that.

liveoneggs 16 days ago | [–]

good try :)

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact