Slack discloses a now fixed critical RCE flaw in its desktop app; Slack paid $1,750 bug bounty to researcher, which critics say is a paltry sum for such a bug
Slack and its scores of desktop app users just dodged a major bullet. — The communications tool relied upon by journalists …
Context & Ripple Effects
This is Slack's second high-profile security episode in recent memory: last year it moved to reset passwords for 1% of users after new information surfaced about its 2015 breach, so a critical RCE in the desktop app lands on a company already carrying that history. The stakes are sized by Slack's own numbers — over 100,000 paid customers and 10M DAUs at last disclosure — meaning a desktop code-execution bug reaches journalists and enterprises that treat the app as core infrastructure.
The bounty amount is the story's second axis. Two months ago Apple paid a researcher $100K for a Sign in with Apple flaw that could hijack any user's account, while an April report argued closed bounty programs with NDAs can buy researcher silence and may even violate labor law. Against that backdrop, $1,750 for a critical RCE reads less like an outlier and more like a data point in a widening gap between what top-tier flaws fetch across programs.
First-order effects
- Slack's desktop users were exposed to remote code execution until this patch shipped, and the researcher who found it received $1,750 — a sum critics immediately flagged as paltry for the severity class.
- Slack's disclosure is now public, so unpatched desktop installs become the immediate attack surface while defenders race to update.
Second-order effects
- Researchers weighing where to report critical findings now have a stark price comparison — Apple's $100K versus Slack's $1,750 — which pushes talent toward higher-paying programs or, per the April critique, toward markets outside official channels entirely.
- Rival collaboration platforms inherit the scrutiny: their own bounty tables get benchmarked against Slack's payout, forcing security teams to reprice critical-severity rewards to keep researchers reporting in-house.
Third-order effects
- If the gap between top payouts and typical program tables persists, bug bounty economics stratify — a handful of large buyers set the market rate for critical flaws while smaller programs struggle to attract serious researchers, echoing the labor-law and silence concerns raised about closed programs.
- As workplace tools like Slack become critical infrastructure with enterprise-scale footprints, vulnerability response shifts from ad-hoc bounty gestures toward standardized, severity-indexed disclosure economics that regulators and customers increasingly expect.
The trend: Bug bounty payouts are diverging sharply by buyer size even as critical flaws in everyday work software carry enterprise-scale risk, pressuring the industry toward standardized severity-based reward structures.