Bug bounties offer legal safe harbor. Right? Right?
CSO Online published this August 2018 article examining how many bug bounty programs omit legal safe harbor protections for good-faith security researchers. Casey Ellis, Bugcrowd's founder, is quoted saying that finding vulnerabilities can frighten software builders but is necessary to compete with adversaries, while Bugcrowd launched Disclose.io to standardize safe harbor practices.
Source description, as published
Bug bounties are all the rage, but many programs do not offer legal safe harbor to good-faith security researchers who wish to report security issues. Caveat bug finder.