Spotify revealed how it was told of a series of information disclosure vulnerabilities for 'one of our highly visible websites,' which meant 'Spotify employee’s credentials, including several high-profile employees, were insufficiently protected.' Those credentials were not used for other systems, but database credentials, API keys, source code, and additional sensitive information could be trivially downloaded. The severity scoring is based upon the industry-standard Common Vulnerability Scoring System (CVSS.) Once that fix is deployed, the hacker gets paid the relevant bounty commensurate with the severity of the report. By adopting a 'Priority 0' approach to site reliability and security, Spotify now has an average time to resolution of 24 days from when a vulnerability is disclosed to a fix being implemented. Those vulnerabilities that are valid get forwarded to the Spotify security team who work with the development team to resolve the issue. Now hackers can submit a report to Spotify via HackerOne, where they can be triaged for scope, validity and severity. Since then, however, things have changed. Unsurprisingly, it didn't receive a massive number of reports this way and managing them by hand wasn't going to scale.

Why Spotify pays hackers to help keep it secureīefore moving to the HackerOne bug bounty platform in May 2017, Spotify relied upon emails to a 'security' mailbox or personal contacts of the Spotify security team to find out about vulnerabilities.

Spotify pc hack