In late April, Chris Poole, aka moot, the founder of 4chan, announced that the site had been hacked and data had been leaked. Although belatedly, to prevent future such incidents, the company announced not only additional security measures, but also a bug bounty program.
Poole announced the bounty program on the company's website a few hours ago. The new vulnerability disclosure program is powered by hackerone.
"We hope that by formally rewarding security researchers who submit security-related bugs, we will be better able to detect and address vulnerabilities that may impact the website and its users," Poole said.
“Safety remains an ongoing priority and commitment for us. Thank you again for being with us, and we apologize if we have disappointed you.”
The websites included in the bug bounty program are 4chan.org, 4channel.org, 4cdn.org and their subdomains.
The company explains that if vulnerabilities are found in third-party services (CloudFlare or nginx), they should be reported to those companies and not to 4chan. However, the company is willing to publish the names of those who discover such flaws in its Hall of Fame.
Currently, 4chan does not offer any cash rewards. Those who disclose security vulnerabilities will only be recognized in the company's Hall of Fame and will receive a 4chan Pass that is valid for one year. The value of the 4chan Pass is not more than $20.
The company's reward amount does not promise the attendance of major security researchers, as they prefer to deal with the discovery of vulnerabilities from companies that pay heavily.
Security experts who may have questions about 4chan's new bug bounty program can email security at 4chan.org.
