What Do Bug Bounty Platforms Store About Their Hackers?
I do care a lot about data protection and privacy things. I’ve also been in the situation, where a bug bounty platform was able to track me down due to an incident, which was the initial trigger to ask myself:
How did they do it? And do I know what these platforms store about me and how they protect this (my) data? Not really. So why not create a little case study to find out what data they process?
One utility that comes in quite handy when trying to get this kind of information (at least for Europeans) is the General Data Protection Regulation (GDPR). The law’s main intention is to give people an extensive right to access and restrict their personal data. Although GDPR is a law of the European Union, it is extra-territorial in scope. So as soon as a company collects data about a European citizen/resident, the company is automatically required to comply with GDPR. This is the case for all bug bounty platforms that I am currently registered on. They probably cover 98% of the world-wide market: HackerOne, Bugcrowd, Synack, Intigriti, and Zerocopter.
Spoiler: All of them have to be GDPR-compliant, but not all seem to have proper processes in place to address GDPR requests.
Creating an Even Playing Field
To create an even playing field, I’ve sent out the same GDPR request to all bug bounty platforms. Since the scenario should be as realistic and real-world as possible, no platform was explicitly informed beforehand that the request, respectively, their answer, is part of a study.
- All platforms were given the same questions, which should cover most of their GDPR response processes (see Art. 15 GDPR):
- All platforms were given the same email aliases to include in their responses.
- All platforms were asked to hand over a full copy of my personal data.
- All platforms were given a deadline of one month to respond to the request. Given the increasing COVID situation back in April, all platforms were offered an extension of the deadline (as per Art. 12 par. 3 GDPR).
Analyzing the Results
First of all, to compare the responses that are quite different in style, completeness, accuracy, and thoroughness, I’ve decided to only count answers that are a part of the official answer.
After the official response, discussions are not considered here, because accepting those might create advantages across competitors. This should give a clear understanding of how thoroughly each platform reads and answers the GDPR request.
Instead of going with a kudos (points) system, I’ve decided to use a "traffic light" rating:
| Indicator | Expectation |
|---|---|
| All good, everything provided, expectations met. | |
| Improvable, at least one (obvious) piece of information is missing, only implicitly answered. | |
| Left out, missing a substantial amount of data or a significant data point and/or unmet expectations. |
This light system is then applied to the different GDPR questions and derived points either from the questions themselves or from the data provided.
Results Overview
To give you a quick overview of how the different platforms performed, here’s a summary showing the lights indicators. For a detailed explanation of the indicators, have a look at the detailed response evaluations below.
| Question | HackerOne | Bugcrowd | Synack | Intigriti | Zerocopter |
|---|---|---|---|---|---|
| Did the platform meet the deadline? (Art. 12 par. 3 GDPR) |
|||||
| Did the platform explicitly validate my identity for all provided email addresses? (Art. 12 par. 6 GDPR) |
|||||
| Did the platform hand over the results for free? (Art. 12 par. 5 GDPR) |
|||||
| Did the platform provide a full copy of my data? (Art. 15 par. 3 GDPR) |
|||||
| Is the provided data accurate? (Art. 5 par. 1 (d) GDPR) |
|||||
| Specific question: Which personal data about me is stored and/or processed by you? (Art. 15 par. 1 (b) GDPR) |
|||||
| Specific question: What is the purpose of processing this data? (Art. 15 par. 1 (a) GDPR) |
|||||
| Specific question: Who has received or will receive my personal data (including recipients in third countries and international organizations)? (Art. 15 par. 1 (c) GDPR) |
|||||
| Specific question: If the personal data wasn’t supplied directly by me, where does it originate from? (Art. 15 par. 1 (g) GDPR) |
|||||
| Specific question: If my personal data has been transferred to a third country or organization, which guarantees are given based on article 46 GDPR? (Art. 15 par. 2 GDPR and Art. 46 GDPR) |
Detailed Answers
HackerOne
Request sent out: 01st April 2020
Response received: 30th April 2020
Response style: Email with attachment
Sample of their response:
| Question | Official Answer | Comments | Indicator |
|---|---|---|---|
| Did the platform meet the deadline? | Yes, without an extension. | – | |
| Did the platform explicitly validate my identity for all provided email addresses? | Via email. | I had to send a random, unique code from each of the mentioned email addresses. | |
| Did the platform hand over the results for free? | No fee was charged. | – | |
| Did the platform provide a full copy of my data? | No. | A copy of the VPN access logs/packet dumps was/were not provided.
However, since this is not a general feature, I do not consider this to be a significant data point, but still a missing one. |
|
| Is the provided data accurate? | Yes. | – | |
| Which personal data about me is stored and/or processed by you? | First- & last name, email address, IP addresses, phone number, social identities (Twitter, Facebook, LinkedIn), address, shirt size, bio, website, payment information, VPN access & packet log | HackerOne provided a quite extensive list of IP addresses (both IPv4 and IPv6) that I have used, but based on the provided dataset it is not possible to say when they started recording/how long those are retained.
HackerOne explicitly mentioned that they are actively logging VPN packets for specific programs. However, they currently do not have any ability to search in it for personal data (it’s also not used for anything according to HackerOne) |
|
| What is the purpose of processing this data? | Operate our Services, fulfill our contractual obligations in our service contracts with customers, to review and enforce compliance with our terms, guidelines, and policies, To analyze the use of the Services in order to understand how we can improve our content and service offerings and products, For administrative and other business purposes, Matching finders to customer programs | – | |
| Who has received or will receive my personal data (including recipients in third countries and international organizations)? | Zendesk, PayPal, Slack, Intercom, Coinbase, CurrencyCloud, Sterling | While analyzing the provided dataset, I noticed that the list was missing a specific third-party called "TripActions", which is used to book everything around live hacking events. This is a missing data point, but it’s also only a non-general one, so the indicator is only orange.
HackerOne added the data point as a result of this study. |
|
| If the personal data wasn’t supplied directly by me, where does it originate from? | HackerOne does not enrich data. | – | |
| If my personal data has been transferred to a third country or organization, which guarantees are given based on article 46 GDPR? | This question wasn’t answered as part of the official response. | I’ve notified HackerOne about the missing information afterwards, and they’ve provided the following:
Vendors must undergo due diligence as required by GDPR, and where applicable, model clauses are in place. |
Remarks
HackerOne provided an automated and tool-friendly report. While the primary information was summarized in an email, I’ve
received quite a huge JSON file, which was quite easily parsable using your preferred scripting language. However, if a
non-technical person would receive the data this way, they’d probably have issues getting useful information out of it.
Bugcrowd
Request sent out: 1st April 2020
Response received: 17th April 2020
Response style: Email with a screenshot of an Excel table
Sample of their response:
| Question | Official Answer | Comments | Indicator |
|---|---|---|---|
| Did the platform meet the deadline? | Yes, without an extension. | – | |
| Did the platform explicitly validate my identity for all provided email addresses? | No identity validation was performed. | I’ve sent the request to their official support channel, but there was no explicit validation to verify it’s really me, for neither of my provided email addresses. | |
| Did the platform hand over the results for free? | No fee was charged. | – | |
| Did the platform provide a full copy of my data? | No. | Bugcrowd provided a screenshot of what looks like an Excel file with a couple of information on it. In fact, the screenshot you can see above is not even a sample but their complete response. However, the provided data is not complete since it misses a lot of data points that can be found on the researcher portal, such as a history of authenticated devices (IP addresses see your sessions on your Bugcrowd profile), my ISC2 membership number, everything around the identity verification. There might be more data points such as logs collected through their (for some programs) required proxies or VPN endpoints, which is required by some programs, but no information was provided about that. Bugcrowd did neither provide anything about all other given email addresses, nor did they deny to have anything related to them. |
|
| Is the provided data accurate? | No. | The provided data isn’t accurate. Address information, as well as email addresses and payment information are super old (it does not reflect my current Bugcrowd settings), which indicates that Bugcrowd stores more than they’ve provided. | |
| Which personal data about me is stored and/or processed by you? | First & last name, address, shirt size, country code, LinkedIn profile, GooglePlus address, previous email address, PayPal email address, website, current IP sign-in, bank information, and the Payoneer ID | This was only implicitly answered through the provided copy of my data.
As mentioned before, it seems like there is a significant amount of information missing. |
|
| What is the purpose of processing this data? | – | This question wasn’t answered. | |
| Who has received or will receive my personal data (including recipients in third countries and international organizations)? | – | This question wasn’t answered. | |
| If the personal data wasn’t supplied directly by me, where does it originate from? | – | This question wasn’t answered. | |
| If my personal data has been transferred to a third country or organization, which guarantees are given based on article 46 GDPR? | – | This question wasn’t answered. |
Remarks
The "copy of my data" was essentially the screenshot of the Excel file, as shown above. I was astonished about the compactness of the answer and asked again to answer all the provided questions as per GDPR. What followed was quite a long discussion with the responsible personnel at Bugcrowd. I’ve mentioned more than once that the provided data is inaccurate and incomplete and that they’ve left out most of the questions, which I have a right by law to get an answer to. Still, they insisted that all answers were GDPR-compliant and complete.
I’ve also offered them an extension of the deadline in case they needed more time to evaluate all questions. However, Bugcrowd did not want to take the extension. The discussion ended with the following answer on 17th April:
We’ve done more to respond to you that any other single GDPR request we’ve ever received since the law was passed. We’ve done so during a global pandemic when I think everyone would agree that the world has far more important issues that it is facing. I need to now turn back to those things.
I’ve given up at that point.
Synack
Request sent out: 25th March 2020
Response received: 03th July 2020
Response style: Email with a collection of PDFs, DOCXs, XLSXs
Sample of their response:
| Question | Answer | Comments | Indicator |
|---|---|---|---|
| Did the platform meet the deadline? | Yes, with an extension of 2 months. | Synack explicitly requested the extension. | |
| Did the platform explicitly validate my identity for all provided email addresses? | No. | I’ve sent the initial request via their official support channel, but no further identity verification was done. | |
| Did the platform hand over the results for free? | No fee was charged. | – | |
| Did the platform provide a full copy of my data? | Very likely not. | Synack uses a VPN solution called "LaunchPoint", respectively "LaunchPoint+" which requires every participant to go through when testing targets. What they do know – at least – is when I am connected to the VPN, which target I am connected to, and how long I am connected to it. However, neither a connection log nor a full dump was provided as part of the data copy.
The same applies to the system called "TUPOC", which was not mentioned. Synack did neither provide anything about all other given email addresses nor did they deny to have anything related to them. Since I do consider these to be significant data points in the context of Synack that weren’t provided, the indicator is red |
|
| Is the provided data accurate? | Yes. | The data that was provided is accurate, though. | |
| Which personal data about me is stored and/or processed by you? | Identity information: full name, location, nationality, date of birth, age, photograph, passport or other unique ID number, LinkedIn Profile, Twitter handle, website or blog, relevant certifications, passport details (including number, expiry data, issuing country), Twitter handle and Github handle
Taxation information: W-BEN tax form information, including personal tax number Account information: Synack Platform username and password, log information, record of agreement to the Synack Platform agreements (ie terms of use, code of conduct, insider trading policy and privacy policy) and vulnerability submission data; Contact details: physical address, phone number, and email address Financial information: bank account details (name of bank, BIC/SWIFT, account type, IBAN number), PayPal account details and payment history for vulnerability submissions Data with respect to your engagement on the Synack Red Team: Helpdesk communications with Synack, survey response information, data relating to the vulnerabilities you submitted through the Synack Platform and data related to your work on the Synack Platform |
Compared to the provided data dump, a couple of information are missing: last visited date, last clicks on link tracking in emails, browser type and version, operating system, and gender are not mentioned, but still processed.
"Log information" in the context of "Account information" and "data related to your work on the Synack Platform" in the context of "Data with respect to your engagement on the Synack Red Team" are too vague since it could be anything. There is no mention of either LaunchPoint, LaunchPoint+ or TUPOC details. Since I do consider these to be significant data points in the context of Synack, the indicator is red. |
|
| What is the purpose of processing this data? | Recruitment, including screening of educational and professional background data prior to and during the course of the interviewing process and engagement, including carrying out background checks (where permitted under applicable law).
Compliance with all relevant legal, regulatory and administrative obligations The administration of payments, special awards and benefits, the management, and the reimbursement of expenses. Management of researchers Maintaining and ensuring the communication between Synack and the researchers. Monitoring researcher compliance with Synack policies Maintaining the security of Synack’s network customer information |
A really positive aspect of this answer is that Synack included the retention times of each data point. | |
| Who has received or will receive my personal data (including recipients in third countries and international organizations)? | Cloud storage providers (Amazon Web Services and Google), identification verification providers, payment processors (including PayPal), customer service software providers, communication platforms and messaging platform to allow us to process your customer support tickets and messages, customers, background search firms, applicant tracking system firm. | Synack referred to their right to mostly only name "categories of third-parties" except for AWS and Google. While this shows some transparency issues, it is still legal to do so. | |
| If the personal data wasn’t supplied directly by me, where does it originate from? | Synack does not enrich data. | – | |
| If my personal data has been transferred to a third country or organization, which guarantees are given based on article 46 GDPR? | Synack engages third-parties in connection with the operation of Synack’s crowdsourced penetration testing business. To the extent your personal data is stored by these third- party providers, they store your personal data in either the European Economic Area or the United States. | The only thing Synack states here is that data is stored in the EEA or the US, but the storage itself is not a safeguard. Therefore the indicator is red. |
Remarks
The communication process with Synack was rather slow because it seems like it takes them some time to get information from different vendors.
Update 23rd July 2020:
One document was lost in the conversations with Synack, which turns a couple of their points from red to green. The document was digitally signed, and due to the added proofs, I can confirm that it has been signed within the deadline set for their GDPR request.
The document itself tries to answer the specific questions, but there are some inconsistencies compared to the also attached copy of the privacy policy (in terms of data points being named in one but not the other document), which made it quite hard to create a unique list of data points. However, I’ve still updated the table for Synack accordingly.
Intigriti
Request sent out: 07th April 2020
Response received: 04th May 2020
Response style: Email with PDF and JSON attachments.
Sample of their response:
| Question | Answer | Comments | Indicator |
|---|---|---|---|
| Did the platform meet the deadline? | Yes, without an extension. | – | |
| Did the platform explicitly validate my identity for all provided email addresses? | Yes. | Via email. I had to send a random, unique code from each of the mentioned email addresses. | |
| Did the platform hand over the results for free? | No fee was charged. | – | |
| Did the platform provide a full copy of my data? | Yes. | I couldn’t find any missing data points. | |
| Is the provided data accurate? | Yes. | – | |
| Which personal data about me is stored and/or processed by you? | First- & lastname, address, phone number, email address, website address, Twitter handle, LinkedIn page, shirt size, passport data, email conversation history, accepted program invites, payment information (banking and PayPal), payout history, IP address history of successful logins, history of accepted program terms and conditions, followed programs, reputation tracking, the time when a submission has been viewed.
Data categories processed: User profile information, Identification history information, Personal preference information, Communication preference information, Public preference information, Payment methods, Payout information, Platform reputation information, Program application information, Program credential information, Program invite information, Program reputation information, Program TAC acceptance information, Submission information, Support requests, Commercial requests, Program preference information, Mail group subscription information, CVR Download information, Demo request information, Testimonial information, Contact request information. |
I couldn’t find any missing data points.
A long, long time ago, Intigriti had a VPN solution enabled for some of their customers, but I haven’t seen it active anymore since then, so I do not consider this data point anymore. |
|
| What is the purpose of processing this data? | Purpose: Public profile display, Customer relationship management, Identification & authorization, Payout transaction processing, Bookkeeping, Identity checking, Preference management, Researcher support & community management, Submission creation & management, Submission triaging, Submission handling by company, Program credential handling, Program inviting, Program application handling, Status reporting, Reactive notification mail sending, Pro-active notification mail sending, Platform logging & performance analysis. | – | |
| Who has received or will receive my personal data (including recipients in third countries and international organizations)? | Intercom, Mailerlite, Google Cloud Services, Amazon Web Services, Atlas, Onfido, Several payment providers (TransferWise, PayPal, Pioneer), business accounting software (Yuki), Intigriti staff, Intigriti customers, encrypted backup storage (unnamed), Amazon SES. | I’ve noticed a little contradiction in their report: while saying data is transferred to these parties (which includes third-country companies such as Google and Amazon), they also included a "Data Transfer" section saying "We do not transfer any personal information to a third country."
After gathering for clarification, Intigriti told me that they’re only hosting in the Europe region in regard to AWS and Google. |
|
| If the personal data wasn’t supplied directly by me, where does it originate from? | Intigriti does not enrich data. | – | |
| If my personal data has been transferred to a third country or organization, which guarantees are given based on article 46 GDPR? | – | This information wasn’t explicitly provided, but can be found in their privacy policy: “We will ensure that any transfer of personal data to countries outside of the European Economic Area will take place pursuant to the appropriate safeguards.”
However, "appropriate safeguards" are not defined. |
Remarks
Intigriti provided the most well-written and structured report of all queried platforms, allowing a non-technical reader to get all the necessary information quickly. In addition to that, a bundle of JSON files were provided to read in all data programmatically.
Zerocopter
Request sent out: 14th April 2020
Response received: 12th May 2020
Response style: Email with PDF
Sample of their response:
| Question | Answer | Comments | Indicator |
|---|---|---|---|
| Did the platform meet the deadline? | Yes, without an extension. | – | |
| Did the platform explicitly validate my identity for all provided email addresses? | Yes | Zerocopter validated all email addresses that I’ve mentioned in my request by asking personal questions about the account in question and by letting me send emails with randomly generated strings from each address. | |
| Did the platform hand over the results for free? | No fee was charged. | – | |
| Did the platform provide a full copy of my data? | Yes. | I couldn’t find any missing data points. | |
| Is the provided data accurate? | Yes. | – | |
| Which personal data about me is stored and/or processed by you? | First-, last name, country of residence, bio, email address, passport details, company address, payment details, email conversations, VPN log data (retained for one month), metadata about website visits (such as IP addresses, browser type, date and time), personal information as part of security reports, time spent on pages, contact information with Zerocopter themselves such as provided through email, marketing information (through newsletters). | I couldn’t find any missing data points. | |
| What is the purpose of processing this data? | Optimisation Website, Application, Services, and provision of information, Implementation of the agreement between you and Zerocopter (maintaining contact) | – | |
| Who has received or will receive my personal data (including recipients in third countries and international organizations)? | Some data might be transferred outside the European Economic Area, but only with my consent, unless it is required for agreement implementation between Zerocopter and me, if there is an obligation to transmit it to government agencies, a training event is held, or the business gets reorganized. | Zerocopter did not explicitly name any of these third-parties, except for "HubSpot". | |
| If the personal data wasn’t supplied directly by me, where does it originate from? | Zerocopter does not enrich data. | – | |
| If my personal data has been transferred to a third country or organization, which guarantees are given based on article 46 GDPR? | – | This information wasn’t explicitly provided, but can be found in their privacy policy: " These third parties (processors) process your personal data exclusively within our assignment and we conclude processor agreements with these third parties which are compliant with the requirements of GDPR (or its Netherlands ratification AVG)". |
Remarks
For the largest part, Zerocopter did only cite their privacy policy, which is a bit hard to read for non-legal people.
Conclusion
For me, this small study holds a couple of interesting findings that might or might not surprise you:
- In general, it seems that European bug bounty platforms like Intigriti and Zerocopter generally do better or rather seem to be better prepared for incoming GDPR requests than their US competitors.
- Bugcrowd and Synack seem to lack a couple of processes to adequately address GDPR requests, which unfortunately also includes proper identity verification.
- Compared to Bugcrowd and Synack, HackerOne did quite well, considering they are also US-based. So being a US platform is no excuse for not providing a proper GDPR response.
- None of the platforms has explicitly and adequately described the safeguards required from their partners to protect personal data. HackerOne has handed over this data after their official response, Intigriti and Zerocopter have not explicitly answered that question. However, both have (vague) statements about it in their corresponding privacy policies. This point does not seem to be a priority for the platforms, or it’s probably a rather rarely asked question.
See you next year 😉