3 years later: a crossed look at Swisscom bounty

3 years after the launch of the bug bounty program at Swisscom it is time to take a step back. This talk starts from the point of view of a (somewhat frustrated) bug hunter and walks back from the launch of the program to the current state. Crossed looks from the company and the researcher outline the difficulties encountered on both sides, shows what improved over time and how. It is a story of collaboration and communication. A second part will disclose some interesting vulnerabilities that were found and fixed through the program. Those are not yet chosen but will probably include RCE, SQLi, prevented data leaks or other high-impact issues.