Launch HN: Federacy (YC S18) – bug bounties for startups

71 pointsby jsulinskialmost 7 years ago

Hey all, we're James and William, founders of Federacy (YC S18). We're building a bug bounty platform for startups. (<a href="https://www.federacy.com" rel="nofollow">https://www.federacy.com</a>)I was an early engineer at MoPub, responsible for security and infrastructure. By the time we were acquired by Twitter, we were 20+ engineers, but growing so fast that building software and systems securely was almost an impossible task. I found that there were never enough hands; I couldn’t peel engineers from revenue-driving features and it was really difficult to find contract or full-time security engineers.William and I started Federacy to make it easier for startups to secure themselves. We think the key is to pair startups with extremely talented, outside security researchers to test their applications for vulnerabilities, review code, and help implement best practices—essentially serving as an outsourced CISO.We saw that the best security minds we knew either weren't interested in a full-time role for a single company, weren’t able to work in the United States, or already had day jobs at the largest Internet companies. We thought that if we provided an efficient, no-bullshit way for them to do work that they enjoy, make a real difference in how startups secure themselves, and make money while honing their skills, we could unlock a huge amount of talent that wasn’t accessible previously.We have a lot of respect for what HackerOne and BugCrowd have built, but they are focused on serving mostly enterprise companies with large engineering and security teams, who can afford their services. Their revenue comes largely from triaging the high volume of low-quality and automated/spam bug reports that come through their platforms. These services can be in the six figure range. It may be a good business, but that isn’t where our passion lies.Startups can’t afford these services and the burden of triaging low-quality bug reports can completely overwhelm even the best dev teams, leaving them worse off than they started.We think there is a better way:• We hand-pair startups with a small team of pre-vetted researchers who are subject matter experts in your stack.• Researchers test your infrastructure for vulnerabilities in an initial scan, and work closely with you to resolve issues and implement best practices.• Your program can be private, where only you and the researchers you approve will have access to your program. You don’t have to provide source code and all initial testing is done with only the information and access your normal users have.• We create your program for you and have you up and running in 5 minutes (or you can self-serve, if you prefer).• We only charge for results (when a researcher finds a vulnerability).We just started building a couple months ago and are looking for early feedback. Here’s an invite link we made for HN:<a href="https://www.federacy.com/signup?invitation_id=3b4d06c5-ac02-4b9b-b0b9-4bf1e72f7f7f" rel="nofollow">https://www.federacy.com/signup?invitation_id=3b4d06c5-ac02-...</a>We’ll be around all day to chat and are very happy to answer any questions as well as discuss how we built our product, security-related topics (systems automation, vulnerability reporting, coping with imposter syndrome, etc.), what it's like building a startup with family (we’re twin brothers), or anything in between.Some specific questions we have:If you’re familiar with other bug bounty platforms, are there any issues we can tackle early on that made the experience frustrating for you?Would you consider contracting an outsourced CISO or a pentest with a security researcher that has reported vulnerabilities to you through your bug bounty program?

5 comments

fridaymorning81almost 7 years ago

We've used HackerOne at a startup I work at (10-20 employees). We had to turn it off because we were getting bombarded every couple days with the same issues, that were just run by crackers/hackers running basic pen test scripts. They all seemed to have the same toolkit, and would just run the same tests and report the same bugs. Most of which were either invalid, or just not a priority and, so, a waste of our time to read. The write-up of the bug was also poor, with poor English, and this causes wasted time..Before signing up for another bug bounty program I'd want to know that:1) The testers were not mostly just amateur crackers running the same toolkit on 100 sites per day, and the same toolkit that 10 testers ran yesterday.2) The amount of dupe reports was basically 0.. If we get a bug reported and we ignore it, and make zero response, we still do not want to get the same report 10 times over the next 2 months.3) The write-ups should have proper English, good grammar, and be very clear.4) If a user reports 10 bugs, and we only want to pay for 1, that should be totally fine. The other 9 are either dupes that we have ignored before, or new reports that are just not a priority or worth looking at.5) We basically never want to get into a negotiation with the hackers over if a payout should be $2000 because 10 bugs were reported when we know of all the bugs and, basically, don't value them.

评论 #17674084 未加载

评论 #17674008 未加载

etermalmost 7 years ago

As a "researcher" I don't find your vulnerability levels too informative. I'd suggest you use or adapt the bugcrowd taxonomy: <a href="https://bugcrowd.com/vulnerability-rating-taxonomy" rel="nofollow">https://bugcrowd.com/vulnerability-rating-taxonomy</a>That is a model that has been shaped from the experience of many programs and has a clear, "yes this is an issue but no you're not getting paid" level which is important for avoiding thousands of time-wasting reports such as non-perfect HTTPS headers, etc.I'd be interested in hearing how you plan to deal with duplcate reports. This is an area that hackerone does better than bugcrowd. Hackerone is more interested in disclosure and getting reports to a point where they can be disclosed. If a bug is marked duplicate you are given access to the original report which prevents falsely marking duplicates to avoid bounties.

评论 #17675161 未加载

tptacekalmost 7 years ago

What does it mean to "contract an outsourced CISO" to a researcher who reported through a bug bounty program? What's an "outsourced CISO"?I think it's unlikely that "CISO" is the word you want to use in your copy.How are you vetting researchers? I logged in as a researcher, and it looks like it works just like H1 works: there are public bounties, and private ones for which admission is gated by performance on the public bounties.It is not the case that H1 typically costs six figures; typical costs for a startup on H1, with triage, are low five figures.We manage bug bounties for several of our clients (we run outsourced security teams for startups). If there's a problem we have with bounties, it's not getting enough submissions from them. Triage can be annoying (I kind of enjoy it), but we do full-scope penetration tests for each of our clients, and it's noteworthy how much more a real pentest finds than a bounty program. There are different incentives, different information available, and different kinds of work result.(There are things bounties do better, too; bounties are good for finding oddball XSS and CSRF problems, and good at corner-case web hygiene stuff).How are you attracting talent? I don't really understand the business model. Bounty researchers already have a bunch of platforms they can use if they want to do bounty-type scanning. Why are they using yours?

评论 #17676862 未加载

ahartman00almost 7 years ago

"Would you consider contracting an outsourced CISO or a pentest with a security researcher that has reported vulnerabilities to you through your bug bounty program?"Budget permitting, this seems like a no brainer. I mean, they already have some familiarity with our app. The only thing I would be worried about is people gaming the system: finding some low hanging fruit or running their toolkits on a bunch of apps, then charging a lot of money and providing no more value.

评论 #17674584 未加载

eganistalmost 7 years ago

Your bullets all line up with what Synack and Cobalt.io are doing. How do you differentiate from the two of them, who themselves are already competing hard with each other? Both of them strictly curate their test base, allow for strictly-private programs, allow for researchers to work closely with firms for resolution, can launch and operate your whole program, and charge per finding.