News

As Devs Code .NET Core, Microsoft Offers Bug Bounty

As developers churn through coding the next versions of .NET Core and other key Microsoft technologies, the company offers new bounties on bugs. Program runs to September.

As the community of developers churning through open sourced versions of the upcoming .NET Core 1.0, ASP.NET Core 1.0 and other key Microsoft technologies, there's bound to be some bugginess to the code. With that, Microsoft is offering a window of opportunity for developers to cash in on discovering bugs with a three-month bug bounty program.

There's actually a number of bug bounty programs being offered by Microsoft, including ones for those discovering bugs with Office 365 and Azure that are ongoing, but most relevant to developers are the ones for .NET Core and ASP.NET Core.

According to a new post on Microsoft's Security TechCenter, the bounty program runs from June 7 to September 7, and is worth $500 to $15,000 if developers submit a discovered vulnerability within .NET Core and ASP.NET Core R2 and other releases that are made available within the next three months.

Developers who want to get a payout for bugs must submit the bug using the Coordinated Vulnerability Disclosure guidelines, and the bug must be original, so timing is key in submissions (as other developers might be discovering the same or similar bugs).

Much of the information on submission and criteria and qualification of bug submissions is on the Program Terms page here. In a nutshell, any submitted vulnerability has to be original and a flaw that hasn't shown up in any vulnerability reports, and the flaw has to be well documented so that Microsoft's security researchers can reproduce the flaw as a proof of concept. Examples of qualified submissions are "bypasses of CSRF protection, Encoding, Data Protection failures, Information disclosures to a client, Authentication bypasses and Remote Code Execution," notes the Program Terms, and must come with exacting steps for reproducing the flaw.

Specific payouts and steps for submitting bugs to the bounty program are available on the Program Terms page in the TechNet Security Center site.

About the Author

Michael Domingo is a long-time software publishing veteran, having started up and managed several developer publications for the Clipper compiler, Microsoft Access, and Visual Basic. He's also managed IT pubs for 1105 Media, including Microsoft Certified Professional Magazine and Virtualization Review before landing his current gig as Visual Studio Magazine Editor in Chief. Besides his publishing life, he's a professional photographer, whose work can be found by Googling domingophoto.

comments powered by Disqus

Featured

  • What's New in Visual Studio 2019 v16.5 Preview 2

    The second preview of Visual Studio 2019 v16.5 has arrived with improvements across the flagship IDE, including the core experience and different development areas such as C++, Python, web, mobile and so on.

  • C# Shows Strong in Tech Skills Reports

    Microsoft's C# programming language continues to show strong in tech industry skills reports, with the most recent examples coming from a skills testing company and a training company.

  • Color Shards

    Sharing Data and Splitting Components in Blazor

    ASP.NET Core Version 3.1 has at least two major changes that you'll want to take advantage of. Well, Peter thinks you will. Depending on your background, your response to one of them may be a resounding “meh.”

  • Architecture Small Graphic

    Microsoft Ships Preview SDK, Guidance for New Dual-Screen Mobile Era

    Microsoft announced a new SDK and developer guidance for dealing with the new dual-screen mobile era, ushered in by the advent of ultra-portable devices such as the Surface Duo.

  • How to Create a Machine Learning Decision Tree Classifier Using C#

    After earlier explaining how to compute disorder and split data in his exploration of machine learning decision tree classifiers, resident data scientist Dr. James McCaffrey of Microsoft Research now shows how to use the splitting and disorder code to create a working decision tree classifier.

.NET Insight

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.

Upcoming Events