In just three weeks, Facebook pays out $40K to hackers
Three weeks after launching a bug bounty program that pays Web hackers cash for finding flaws with its website, Facebook said it has paid out more than US$40,000 in rewards. — Three weeks after launching a bug bounty program …
Context & Ripple Effects
The $40,000 figure lands three weeks after Facebook confirmed it would pay web hackers cash for flaws found on its site, making this the first public read on whether the program would actually attract submissions. It also arrives days before the company's confirmed September 22 f8 developer conference in San Francisco, where Facebook typically unveils major features.
Scale is what makes the experiment notable: per coverage earlier the same week, Facebook topped web traffic with 870 million uniques, ahead of YouTube at 790 million and Yahoo at 590 million. A fast payout rate suggests the largest property on the web is treating outside researchers as a working part of its security operation heading into a feature-heavy fall.
First-order effects
- Independent security researchers gain a direct cash channel into Facebook's web stack, converting flaw reports that might otherwise sit undisclosed or unsold into paid submissions.
- Facebook heads into its September 22 f8 conference with a publicly measurable security mechanism — over $40,000 out the door in three weeks — rather than a vague goodwill pledge.
Second-order effects
- The disclosed payout rate gives researchers a concrete price benchmark for web vulnerabilities, raising the bar for any large platform still relying on unpaid responsible disclosure.
- With 870 million uniques exposed, paying crowdsourced finders becomes a cheaper line item than remediating exploits discovered maliciously at that scale.
Third-order effects
- If the payout cadence holds, bug bounties shift from occasional gestures to standing procurement of security labor, with major web properties effectively competing for researcher attention as a supply market.
The trend: Web platforms are institutionalizing vulnerability discovery, turning independent hackers into a paid, ongoing security supply chain rather than ad hoc good Samaritans.