News

As Devs Code .NET Core, Microsoft Offers Bug Bounty

As developers churn through coding the next versions of .NET Core and other key Microsoft technologies, the company offers new bounties on bugs. Program runs to September.

As the community of developers churning through open sourced versions of the upcoming .NET Core 1.0, ASP.NET Core 1.0 and other key Microsoft technologies, there's bound to be some bugginess to the code. With that, Microsoft is offering a window of opportunity for developers to cash in on discovering bugs with a three-month bug bounty program.

There's actually a number of bug bounty programs being offered by Microsoft, including ones for those discovering bugs with Office 365 and Azure that are ongoing, but most relevant to developers are the ones for .NET Core and ASP.NET Core.

According to a new post on Microsoft's Security TechCenter, the bounty program runs from June 7 to September 7, and is worth $500 to $15,000 if developers submit a discovered vulnerability within .NET Core and ASP.NET Core R2 and other releases that are made available within the next three months.

Developers who want to get a payout for bugs must submit the bug using the Coordinated Vulnerability Disclosure guidelines, and the bug must be original, so timing is key in submissions (as other developers might be discovering the same or similar bugs).

Much of the information on submission and criteria and qualification of bug submissions is on the Program Terms page here. In a nutshell, any submitted vulnerability has to be original and a flaw that hasn't shown up in any vulnerability reports, and the flaw has to be well documented so that Microsoft's security researchers can reproduce the flaw as a proof of concept. Examples of qualified submissions are "bypasses of CSRF protection, Encoding, Data Protection failures, Information disclosures to a client, Authentication bypasses and Remote Code Execution," notes the Program Terms, and must come with exacting steps for reproducing the flaw.

Specific payouts and steps for submitting bugs to the bounty program are available on the Program Terms page in the TechNet Security Center site.

About the Author

Michael Domingo is a long-time software publishing veteran, having started up and managed several developer publications for the Clipper compiler, Microsoft Access, and Visual Basic. He's also managed IT pubs for 1105 Media, including Microsoft Certified Professional Magazine and Virtualization Review before landing his current gig as Visual Studio Magazine Editor in Chief. Besides his publishing life, he's a professional photographer, whose work can be found by Googling domingophoto.

comments powered by Disqus

Featured

  • GitHub Copilot for Azure Gets Preview Glitches

    This reporter, recently accepted to preview GitHub Copilot for Azure, has thus far found the tool to be, well, glitchy.

  • New .NET 9 Templates for Blazor Hybrid, .NET MAUI

    Microsoft's fifth preview of .NET 9 nods at AI development while also introducing new templates for some of the more popular project types, including Blazor Hybrid and .NET MAUI.

  • What's Next for ASP.NET Core and Blazor

    Since its inception as an intriguing experiment in leveraging WebAssembly to enable dynamic web development with C#, Blazor has evolved into a mature, fully featured framework. Integral to the ASP.NET Core ecosystem, Blazor offers developers a unique combination of server-side rendering and rich client-side interactivity.

  • Nearest Centroid Classification for Numeric Data Using C#

    Here's a complete end-to-end demo of what Dr. James McCaffrey of Microsoft Research says is arguably the simplest possible classification technique.

  • .NET MAUI in VS Code Goes GA

    Visual Studio Code's .NET MAUI workload, which evolves the former Xamarin.Forms mobile-centric framework by adding support for creating desktop applications, has reached general availability.

Subscribe on YouTube