This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit

Bug Bounty Projects

Revision as of 12:20, 30 April 2016 by Johanna Curiel (talk | contribs) (Bug Bounty Program for OWASP projects)

Jump to: navigation, search

Bug Bounty Program for OWASP projects


Many developers and companies looking to implement security are turning towards OWASP to use Defender libraries that they can implement to secure their critical applications. Since this implies a form of trust in OWASP, many users of these projects might forget or not be aware that many of them are Open Source and lack an expected security assurance review, which at the moment is not done by OWASP.

Testing web applications for security can be a challenging task. But testing that security control libraries are robust in the face of attack is an even more difficult challenge for even the most sophistical assessment professionals.


After a tender process to select a service Bug Bounty Program provider that took place from February till April 2016 , BugCrowd was selected by OWASP for conducting a Bug Bounty Program for specific OWASP projects.

BugCrowd provides their platform and services to allow OWASP projects conduct specific Bug Bounty programs for Defender category projects but also, any other Code Project that needs to be installed and could create vulnerabilities in the installed computer.

Projects that are vulnerable in nature, such as WebGoat, are not part of this initiative. Projects that are not mature enough , such as alpha releases should also not participate in the program.

Bug Bounty Program Process

A project that wants to be part of the bug bounty should fulfill the following criteria:

  • It must be a Code Project
  • Should be part of a defender category
  • Should have a stable and mature release version (according to the [model])


In order to define the bounties, first, the scope needs to be defined.

The following is a defined scope for the Bug Bounty Program for OWASP CRSFGuard