Find a Security Vulnerability, Get a Reward: Announcing EFF's Security Vulnerability Disclosure Program
At EFF we put security and privacy first. This means working hard at keeping our members and site visitors safe, as well as the people who use the software we develop. We also dedicate staff time to advising security researchers, maintaining resources like our Coders' Rights Project, and helping groups like Facebook improve their bug reporting policies.
Today we're following our own advice by announcing EFF's own Security Vulnerability Disclosure Program. The Disclosure Program is a set of guidelines on how to report bugs in software EFF develops, like HTTPS Everywhere or Let's Encrypt, as well as the software we use to run our sites and services. The scope of the bugs we're looking for is detailed on the Security Vulnerability Disclosure Program page, but we're not just looking for bugs in our code. Security vulnerabilities created by the specific configuration of software on EFF servers are also within the scope of this program.
