Oath is getting serious about security with a new unified bug bounty program.
Until now, several brands siting under the Oath umbrella—AOL, Yahoo, Tumblr, and Verizon Digital Media Services (VDMS)—have had their own big bounty programs. Starting today, they will come together as part of a combined program on the bug bounty platform HackerOne.
"Security researchers will be able to work on the AOL, VDMS and Tumblr properties on an invite-only basis, while the Yahoo properties will be open to the public," Oath CISO and "Paranoid in Chief" Chris Nims announced in a blog post. "Importantly, every Oath property is under the purview of the unified program."
To kick off new program, Oath invited 40 white hats to San Francisco last weekend to hack its systems. Following the nine-hour hackathon, Oath ended up paying more than $400,000 in bounties.
"Surfacing vulnerabilities and resolving them before our adversaries can exploit them is essential in helping us build brands people love and trust," Nims wrote.
Oath hasn't yet specified exactly how much researchers can earn from their responsible disclosures, but said its program "offers some of the most competitive rewards." Both Google and Apple offer maximum bug bounty payouts of $200,000.
Oath said it will take into account "what data might have been exposed, the sensitivity of that data, the role that data plays, network location and the permissions of the server involved." The company advised researchers to "include thorough explanations with their bug reporting" for the highest potential payouts.
The move comes about a year and a half after Yahoo disclosed that up to 1 billion accounts were breached.