Understanding the Heterogeneity of Contributors in Bug Bounty Programs
This provides insights for improving bug bounty programs and studying new software development roles, but it is incremental as it builds on existing knowledge without major breakthroughs.
The paper tackled the lack of empirical knowledge about bug bounty program contributors by analyzing 82 programs and 2,504 contributors, finding that project-specific and non-specific contributors have different motivations.
Background: While bug bounty programs are not new in software development, an increasing number of companies, as well as open source projects, rely on external parties to perform the security assessment of their software for reward. However, there is relatively little empirical knowledge about the characteristics of bug bounty program contributors. Aim: This paper aims to understand those contributors by highlighting the heterogeneity among them. Method: We analyzed the histories of 82 bug bounty programs and 2,504 distinct bug bounty contributors, and conducted a quantitative and qualitative survey. Results: We found that there are project-specific and non-specific contributors who have different motivations for contributing to the products and organizations. Conclusions: Our findings provide insights to make bug bounty programs better and for further studies of new software development roles.