Slack informed bug bounty hunters on Monday that it has increased the minimum rewards for serious vulnerabilities found in its products and websites.
Through its HackerOne-powered bug bounty program, Slack will be offering at least $2,500 for high-severity vulnerabilities and $5,000 for critical issues reported between October 28 and November 27. Until now, the company has offered $1,500 for critical flaws and $1,000 for high-severity vulnerabilities.
“HackerOne’s bug bounty program and researchers have played an integral part in improving the overall security posture of Slack. Over the course of five years, the Slack team has resolved over 900 vulnerabilities thanks to over 450 hackers participating in our program. A huge accomplishment,” said Branden Jordan, staff technical program manager at Slack.
Slack has paid out a total of nearly $500,000 since the launch of its bug bounty program, with top bounties ranging between $1,000 and $10,000.
The company’s bug bounty program targets the official Slack applications and other apps maintained by Slack, along with slack.com and various other web resources.
One interesting flaw reported recently to Slack impacted the desktop app for Windows and it could have been exploited to steal and manipulate a user’s downloaded file. However, an attack required user interaction and in some cases authentication, which is why the security hole was only classified as “medium severity” and earned the researcher who found it $500.
Slack recently informed customers that it had reset passwords for accounts that had not been secured after the data breach suffered by the company back in 2015.
Related: Slack Unveils New Enterprise Security Tools
Related: Slack Introduces Enterprise Key Management Tool
Related: Slack Lists Cybersecurity Risks Ahead of Going Public