# bounty Published articles for bounty. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## $1 million hacker challenge for Vercel Sandbox DevFeed: [$1 million hacker challenge for Vercel Sandbox]() Original publisher: [Read original article]() Author: Andy Riancho Published: 2026-08-18T13:00:00Z Content type: article Language: en Sources: [Vercel News]() Topics: [Vercel](), [Firecracker](), [Security](), [vulnerability](), [Network](), [Amazon EC2](), [Linux](), [Open Source]() Tags: [agents](), [bounty](), [firecracker](), [linux](), [network](), [open-source](), [sandbox](), [security](), [vercel](), [vulnerability]() ### AI overview Vercel announces a two-week public HackerOne challenge offering up to $1 million in total payouts for researchers who can escape Vercel Sandbox isolation. The article explains that Sandbox uses Firecracker microVMs on bare-metal Amazon EC2 hosts, with host-side network controls forming part of the security boundary. Individual reports can receive up to $50,000 for vulnerabilities allowing access to another Vercel tenant's data. ### Source excerpt Agents need to run untrusted code, and the microVM has become the standard way to do it: a dedicated guest kernel per workload, isolated from the host and from every other workload on the same machine. But recent security research and real-world incidents have revealed that agents running untrusted code do not need to cross a VM boundary to escape containment; they only need one network path the security model failed to account for, which we explained in our post A sandbox without a network boundary is only half a sandbox. Isolation only holds if both sides of it hold: the Firecracker microVM and the host-side network controls. Recently our CTO pointed an open-weight model with no safeguards at Vercel Sandbox. It did not escape, but it mapped the guest kernel, built a VM to reproduce its ideas, and wrote a fuzzer. Defenders have first-mover advantage, but it won't last forever, and the choice is when to test the boundaries (we strongly encourage building a scanning program, which you can do on any budget with an open-source tool like deepsec and AI Gateway). We are proactively choosing to test Vercel Sandbox on our own schedule, not an attacker's, and we are doing it in the open, with the best researchers in the world. So for two weeks, we are paying up to $1,000,000 USD to the researchers who can escape a Vercel Sandbox. The challenge Starting today, Vercel is running a two-week public HackerOne program focused on Vercel Sandbox isolation. Program: Public HackerOne program, open to all eligible researchers Window: Tuesday, August 18 to Tuesday, September 1, 2026, or earlier if the reward pool is exhausted Max per report: $50,000 USD, for a vulnerability that lets a threat actor read or modify another Vercel tenant's data Total pool: Up to $1,000,000 USD in total payouts Bounties are paid per report, scoped to a single root cause, and assigned by Vercel triage based on the maximum demonstrable impact. The full bounty table, detailed scope, and the list of known-dupl ## Burp's new Ambassadors: learn from the people who use Burp Suite everyday DevFeed: [Burp's new Ambassadors: learn from the people who use Burp Suite everyday]() Original publisher: [Read original article]() Author: Fran Hutchings Published: 2026-07-17T13:35:25Z Content type: article Language: en Sources: [PortSwigger Blog]() Topics: [Application Security](), [web applications](), [Cybersecurity](), [Mobile Security](), [Bug Bounty]() Tags: [ambassador](), [application-security](), [bounty](), [bug-bounty](), [community](), [cybersecurity](), [mobile](), [security](), [testing](), [web]() ### AI overview PortSwigger introduces four new Burp Ambassadors and highlights their contributions to web application security, including research, education, penetration testing, bug bounty work, community events, and practical Burp Suite workflows. ### Source excerpt Growing our Burp Ambassador community Meet our newest Burp Ambassadors Katie Paxton-Fear Malek Mohammad Yogesh Tantak James Lester Looking ahead Interested in getting involved? Growing our Burp Ambass ## GPT-5.5 Bio Bug Bounty DevFeed: [GPT-5.5 Bio Bug Bounty]() Original publisher: [Read original article]() Published: 2026-07-09T10:00:00Z Content type: news Language: en Sources: [OpenAI News]() Topics: [Bug Bounty](), [Jailbreak](), [OpenAI](), [Frontier AI](), [Artificial Intelligence](), [ChatGPT]() Tags: [ai](), [bounty](), [bug-bounty](), [frontier-ai](), [gpt](), [jailbreak](), [models](), [openai](), [safety]() ### AI overview OpenAI is turning its GPT-5.5 Bio Bug Bounty into an ongoing private Bio Bounty Program focused on universal jailbreaks against biosafety challenges for frontier models. Rewards for qualifying GPT-5.5 and GPT-5.6 findings have increased from $25,000 to $50,000. ### Source excerpt Details about the OpenAI Bio Bounty program ## Chainguard Launches Bugcrowd Bug Bounty With Up to $200,000 in Rewards DevFeed: [Chainguard Launches Bugcrowd Bug Bounty With Up to $200,000 in Rewards]() Original publisher: [Read original article]() Published: 2026-07-06T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [Bug Bounty](), [Security](), [Vulnerabilities](), [Exploit](), [npm packages]() Tags: [bounty](), [bug-bounty](), [bugcrowd-bug-bounty](), [chainguard-bug-bounty](), [chainguard-security](), [exploit](), [malicious-packages](), [npm-packages](), [security](), [security-contest](), [shai-hulud](), [supply-chain](), [vulnerabilities]() ### AI overview Chainguard is running a Bugcrowd bug bounty from July 6-27, offering up to $200,000 to researchers who find vulnerabilities in its infrastructure and products. ### Source excerpt Chainguard launches a Bugcrowd bounty with up to $200K in rewards, inviting researchers to test its infrastructure against real-world attacks. ## PortSwigger partners with Meta Bug Bounty to empower bug hunters with training and Pro licenses DevFeed: [PortSwigger partners with Meta Bug Bounty to empower bug hunters with training and Pro licenses]() Original publisher: [Read original article]() Author: Fran Hutchings Published: 2026-04-07T12:12:07Z Content type: release Language: en Sources: [PortSwigger Blog]() Topics: [Bug Bounty](), [Application Security](), [Web](), [Meta](), [Tooling]() Tags: [accessibility](), [bounty](), [bug-bounty](), [collaboration](), [education](), [meta](), [partners](), [security](), [tooling](), [training](), [web]() ### AI overview PortSwigger announces a partnership with Meta Bug Bounty to provide eligible bug hunters with training, learning pathways, and Burp Suite Professional licenses. The initiative aims to improve testing efficiency, help researchers identify high-impact vulnerabilities, and strengthen the global security research community. ### Source excerpt More power for bug hunters An education-first approach to bug bounty Rewards on Meta's Bug Bounty Platform Our shared vision Ready to get started? We're excited to announce a new partnership with Meta ## VRP 2025 Year in Review DevFeed: [VRP 2025 Year in Review]() Original publisher: [Read original article]() Author: Kimberly Samra (noreply@blogger.com) Published: 2026-03-31T16:55:00Z Content type: article Language: en Sources: [Google Online Security]() Topics: [Bug Bounty](), [Google](), [Security](), [Vulnerabilities](), [Artificial Intelligence](), [Chrome](), [Open Source]() Tags: [ai](), [bounty](), [bug-bounty](), [chrome](), [dependencies](), [google](), [none](), [open-source](), [security](), [vulnerabilities]() ### AI overview Google's 2025 Vulnerability Reward Program review marks its 15th anniversary and reports more than $17 million awarded to over 700 security researchers. It also describes a dedicated AI VRP, expanded Chrome rewards for AI-related issues, OSV-SCALIBR patch rewards, and security community events. ### Source excerpt Posted by Dirk Gรถhmann, Tony Mendez, and the Vulnerability Rewards Program Team 2025 marked a special year in the history of vulnerability rewards and bug bounty programs at Google: our 15th anniversary ๐ŸŽ‰๐ŸŽ‰๐ŸŽ‰! Originally started in 2010, our vulnerability reward program (VRP) has seen constant additions and expansions over the past decade and a half, clearly indicating the value the programs under this umbrella contribute to the safety and security of Google and its users, but also highlighting their acceptance by the external research community, without which such programs cannot function. Coming back to 2025 specifically, our VRP once again confirmed the ongoing value of engaging with the external security research community to make Google and its products safer. This was more evident than ever as we awarded over $17 million (an all-time high and more than 40% increase compared to 2024!) to over 700 researchers based in countries around the globe - across all of our programs. Vulnerability Reward Program 2025 in Numbers Want to learn more about who's reporting to the VRP? Check out our Leaderboard on the Google Bug Hunters site. VRP Highlights in 2025 In 2025 we made a series of changes and improvements to our VRP and related initiatives, and continued to invest in the security research community through a series of focused events: The new, dedicated AI VRP was launched, underscoring the importance of this space to Google and its relevance for external researchers. Previously organized as a part of the Abuse VRP, moving into a dedicated VRP has gone hand in hand with improvements to the rules, offering researchers more clarity on scope and reward amounts. Similarly, the Chrome VRP now also includes reward categories for problems found in AI features. We launched a patch rewards program for OSV-SCALIBR, Google's open source tool for finding vulnerabilities in software dependencies. Contributors are rewarded for providing novel OSV-SCALIBR plugins for inventory, vulne ## Welcome to AI pentesting - add on-demand AI assistance directly to your workflow with new, agentic Burp AI capabilities DevFeed: [Welcome to AI pentesting - add on-demand AI assistance directly to your workflow with new, agentic Burp AI capabilities]() Original publisher: [Read original article]() Author: Amelia Coen Published: 2025-09-24T14:17:34Z Content type: article Language: en Sources: [PortSwigger Blog]() Topics: [Artificial Intelligence](), [Security](), [Testing](), [Vulnerabilities]() Tags: [agentic](), [ai](), [bounty](), [security](), [testing](), [tools](), [validation](), [vulnerabilities](), [workflow](), [xss]() ### AI overview The article introduces agentic Burp AI capabilities that provide on-demand assistance within penetration-testing workflows. Burp AI can explain behavior, suggest attack ideas and payloads, validate findings, analyze request and response data, automate repetitive tasks, and help test for vulnerabilities such as stored XSS while keeping the tester in control. ### Source excerpt Whether you're navigating a client pentest or chasing a bounty target, even the most experienced testers hit roadblocks, burn time on repetitive tasks, or just want a second opinion. Burp AI is design ## How to join the desync endgame: Practical tips from pentester Tom Stacey DevFeed: [How to join the desync endgame: Practical tips from pentester Tom Stacey]() Original publisher: [Read original article]() Author: Andrzej Matykiewicz Published: 2025-09-18T15:51:39Z Content type: article Language: en Sources: [PortSwigger Blog]() Topics: [HTTP](), [Vulnerabilities](), [Exploit](), [Bug Bounty](), [Testing]() Tags: [bounty](), [bug-bounty](), [guest-post](), [http](), [research](), [techniques](), [testing](), [vulnerabilities]() ### AI overview This guest post presents practical guidance for joining research into HTTP/1.1 desynchronization vulnerabilities. It discusses HTTP Request Smuggling, two novel desync vulnerability classes, their impact on major CDNs, bug bounty opportunities, and a newer scanning technique intended to identify request-boundary problems. ### Source excerpt Note: This is a guest post by pentester and researcher, Tom Stacey (@t0xodile). You'd think that after almost 21 years since its initial public discovery, HTTP Request Smuggling would be barely exploi ## Ethereum Announces Four-Week Fusaka Audit Contest DevFeed: [Ethereum Announces Four-Week Fusaka Audit Contest]() Original publisher: [Read original article]() Author: Ethereum Protocol Security Research Team Published: 2025-09-15T00:00:00Z Content type: release Language: en Sources: [Ethereum Foundation Blog]() Topics: [Vulnerabilities](), [Security](), [Ethereum](), [Bug Bounty]() Tags: [bounty](), [bug-bounty](), [ethereum](), [security](), [security-platform](), [smart-contract](), [vulnerabilities]() ### AI overview Ethereum has launched a four-week audit contest for the Fusaka upgrade, hosted on Sherlock and co-sponsored by Gnosis and Lido. The contest is intended to identify vulnerabilities before they affect the network, with time-limited point multipliers for early valid findings. ### Source excerpt Today, we are excited to announce the start of the Fusaka audit contest, co-sponsored by Gnosis and Lido, hosted on Sherlock, and running for four weeks from September 15th. The goal is simple: maximize scrutiny of the Fusaka upgrade and surface vulnerabilities before they can impact the network. To... ## Pectra Audit Competition Launches on Cantina DevFeed: [Pectra Audit Competition Launches on Cantina]() Original publisher: [Read original article]() Author: Protocol Security Research Team Published: 2025-02-21T00:00:00Z Content type: release Language: en Sources: [Ethereum Foundation Blog]() Topics: [Ethereum](), [Security](), [Vulnerabilities](), [Protocol (disambiguation)]() Tags: [announce](), [audit](), [bounty](), [event](), [security](), [vulnerabilities]() ### AI overview Ethereum announces the Pectra Audit Competition on Cantina, running from February 21 to March 24. The competition seeks vulnerabilities in Pectra-specific code before the mainnet hard fork and outlines key Pectra changes, including account features, validator updates, withdrawals, and increased blob capacity. ### Source excerpt Today, we're excited to announce the Pectra Audit Competition, kicking off on Cantina! This month-long event will run from February 21 to March 24, and we're excited to see what issues the security community can find.... ## Bugbounty and Pentests at Neon DevFeed: [Bugbounty and Pentests at Neon]() Original publisher: [Read original article]() Author: Busra Demir Published: 2024-11-25T16:43:38Z Content type: article Language: en Sources: [Blog -- Neon Docs]() Topics: [Bug Bounty](), [Security](), [Cybersecurity](), [Vulnerabilities](), [Serverless](), [Open Source](), [Database](), [Authentication](), [tenant data protection](), [API]() Tags: [api-security](), [authentication](), [bounty](), [bug-bounty](), [company](), [cybersecurity](), [data-protection](), [launch](), [open-source](), [partnership](), [platform](), [privacy](), [production](), [security](), [serverless](), [vulnerabilities]() ### AI overview Neon announces a private Bug Bounty Program in partnership with HackerOne and describes three penetration tests that identified and resolved 58 vulnerabilities. The program covers authentication, data protection, API security, production, and staging environments, with rewards based on severity and defined response targets. ### Source excerpt At Neon, security is at the core of everything we do. Our serverless platform was built with a vision for innovation, but we also know that a commitment to security is paramount. That's why we're excited to announce the launch of our Neon's Bug Bounty Program in partnership with... ## Ethereum Foundation Announces 2025 Internship Program DevFeed: [Ethereum Foundation Announces 2025 Internship Program]() Original publisher: [Read original article]() Author: EF Protocol Support Published: 2024-11-16T00:00:00Z Content type: release Language: en Sources: [Ethereum Foundation Blog]() Topics: [Ethereum](), [Development](), [Security](), [Bug Bounty]() Tags: [2025](), [applications](), [bounty](), [cybersecurity](), [internship](), [program](), [research-development](), [security]() ### AI overview The Ethereum Foundation has opened applications for its first formal summer internship program, scheduled for 2025. The approximately 12-week program includes research and development roles, mentorship, and projects related to Ethereum. ### Source excerpt The 2025 Ethereum Foundation internship applications are open! Both research and development teams have open positions. Applications close on December 9, 2024. The Ethereum Foundation is running its first formal summer internship program in 2025 aimed at nurturing the next generation of Ethereum developers and researchers. In... ## 0Din: A GenAI Bug Bounty Program - Securing Tomorrow's AI Together DevFeed: [0Din: A GenAI Bug Bounty Program - Securing Tomorrow's AI Together]() Original publisher: [Read original article]() Author: Marco Figueroa Published: 2024-08-08T18:39:13Z Content type: article Language: en Sources: [Mozilla Hacks - the Web developer blog]() Topics: [genai](), [Artificial Intelligence](), [Security](), [Vulnerabilities](), [ai security](), [prompt injection](), [Jailbreak]() Tags: [ai](), [ai-security](), [artificial-intelligence](), [bounty](), [bug-bounty](), [bugs](), [coding](), [featured-article](), [genai](), [jailbreak](), [prompt-injection](), [security](), [vulnerabilities]() ### AI overview This article introduces 0Din, a GenAI bug bounty program focused on identifying and mitigating vulnerabilities in AI systems. It explains the reporting and review process, reward criteria, covered vulnerability types, and participant eligibility. ### Source excerpt As AI continues to evolve, so do the threats against it. As these GenAI systems become more sophisticated and widely adopted, ensuring their security and ethical use becomes paramount. 0Din is a groundbreaking GenAI bug bounty program dedicated specifically to help secure GenAI systems and beyond. In this blog, you'll learn about 0Din, how it works, and how you can participate and make a difference in securing our AI future. The post 0Din: A GenAI Bug Bounty Program - Securing Tomorrow's AI Together appeared first on Mozilla Hacks - the Web developer blog. ## Shopify's Bug Bounty Program Raises Maximum Payout in 2022 DevFeed: [Shopify's Bug Bounty Program Raises Maximum Payout in 2022]() Original publisher: [Read original article]() Author: Jenn Newton Published: 2022-03-22T18:56:46Z Content type: news Language: en Sources: [Shopify Engineering](), [Shopify Engineering - Shopify Engineering]() Topics: [Application Security]() Tags: [announcements](), [application-security](), [bounty](), [bug](), [bug-bounty](), [security](), [shopify]() ### AI overview Shopify announces 2022 changes to its bug bounty program, doubling the maximum CVSS 10.0 reward to $100,000 and classifying several services as Core assets for higher-severity payouts. ### Source excerpt In 2022, Shopify's Bug Bounty Program is doubling the maximum reward to $100,000 and moving key services into the highest severity level. ## Bug Bounty Findings on BLS Primitives in Beacon Chain Specifications and Clients DevFeed: [Bug Bounty Findings on BLS Primitives in Beacon Chain Specifications and Clients]() Original publisher: [Read original article]() Author: Antonio Sanso Published: 2021-09-09T00:00:00Z Content type: article Language: en Sources: [Ethereum Foundation Blog]() Topics: [Security](), [Bug Bounty](), [Cryptography](), [vulnerability](), [Blockchain](), [Fuzzing/Fuzz testing](), [client]() Tags: [blockchain](), [bounty](), [bug-bounty](), [cryptography](), [development](), [fuzzing](), [research-development](), [security](), [vulnerability]() ### AI overview This first post in a security series examines bug bounty submissions targeting BLS primitives used in the beacon chain and consensus layer. It discusses specification oversights, implementation mistakes, and implementation violations, including issues found through differential fuzzing. The article states that all bugs mentioned had already been fixed. ### Source excerpt Earlier this year, we launched a bug bounty program focused on finding issues in the beacon chain specification, and/or in client implementations (Lighthouse, Nimbus, Teku, Prysm etc...). The results (and vulnerability reports) have been enlightening as have the lessons learned while patching potential issues. In this new series, we... ## Ethereum 2.0 update: Phase 0 bounties, Schlesi testnet, and v0.12 preparation DevFeed: [Ethereum 2.0 update: Phase 0 bounties, Schlesi testnet, and v0.12 preparation]() Original publisher: [Read original article]() Author: Danny Ryan Published: 2020-05-06T00:00:00Z Content type: news Language: en Sources: [Ethereum Foundation Blog]() Topics: [Ethereum](), [Network](), [Security](), [Internet Engineering Task Force (IETF)]() Tags: [bounty](), [bug](), [build](), [ethereum](), [ietf](), [release](), [research-development](), [security](), [standard]() ### AI overview This Ethereum 2.0 update announces doubled rewards in the Phase 0 pre-launch bounty program, reports progress on the Schlesi multi-client testnet, and outlines preparation for specification version v0.12. ### Source excerpt We've all been pretty busy with all the things! I'll try to keep these posts rolling out, but in the meantime, be sure to checkout Ben Edgington's What's New in Eth2 to get your fix. Tune into Ethereal Virtual Summit this Thursday and Friday! It's full of excellent eth2... ## Eth2 Phase 0 audit completed, pre-launch bounty program announced DevFeed: [Eth2 Phase 0 audit completed, pre-launch bounty program announced]() Original publisher: [Read original article]() Author: Danny Ryan Published: 2020-03-31T00:00:00Z Content type: release Language: en Sources: [Ethereum Foundation Blog]() Topics: [Ethereum](), [P2P](), [Development]() Tags: [announcements](), [attacks](), [audit](), [bounty](), [bugs](), [ethereum](), [p2p](), [research-development](), [update]() ### AI overview This Eth2 update reports the completion of Least Authority's comprehensive audit of the Phase 0 specifications, including patched DoS vectors and further investigation of identified concerns. It also announces a pre-launch bug bounty program with rewards of up to $10,000 and describes efforts to unify eth1 and eth2 communications. ### Source excerpt Have some fun announcements for y'all this week :) Other than the items below, client teams continue to move toward production. More on that next week! tl;dr Least Authority Phase 0 audit complete Phase 0 Pre-Launch Bounty Program ๐Ÿ› Unification of eth1+eth2 communications in the Eth R&D... ## Announcing Ethereum Foundation and Co-Funded Grants DevFeed: [Announcing Ethereum Foundation and Co-Funded Grants]() Original publisher: [Read original article]() Author: Ethereum Foundation Published: 2019-08-26T00:00:00Z Content type: release Language: en Sources: [Ethereum Foundation Blog]() Topics: [Ethereum](), [Development](), [networking](), [interoperability](), [Security](), [JavaScript](), [browser](), [Nim](), [Tooling]() Tags: [beacon](), [bounty](), [bug-fixes](), [ecosystem-support-program](), [ethereum](), [funding](), [interoperability](), [javascript](), [launch](), [networking](), [security]() ### AI overview The Ethereum Foundation announces more than $2 million in Foundation-led and co-funded grants for Serenity (Eth2.0) development. Funding supports client implementations, Beacon Chain and testnet work, networking and interoperability, security research, and Lodestar JavaScript development, alongside open research and development bounties. ### Source excerpt We are today unveiling over $2M USD in Foundation-led and co-funded grant funding aimed at furthering Serenity (Eth2.0) development as we move nearer to the launch of the Beacon Chain.... ## Bug Bounty Year in Review 2018 DevFeed: [Bug Bounty Year in Review 2018]() Original publisher: [Read original article]() Author: Peter Yaworski Published: 2018-12-20T18:27:00Z Content type: article Language: en Sources: [Shopify Engineering](), [Shopify Engineering - Shopify Engineering]() Topics: [Bug Bounty](), [Shopify](), [Application Security](), [Security](), [vulnerability](), [Hacking](), [pull-requests]() Tags: [application-security](), [bounty](), [bug-bounty](), [hacking](), [reports](), [review](), [security](), [shopify](), [vulnerability]() ### AI overview Shopify's 2018 Bug Bounty year-in-review describes its security program, community of researchers, HackerOne partnership, live hacking event, and improved report triage. Average triage time fell from four days in 2017 to 10 hours in 2018 through a dedicated weekly triager and severity-based validation and escalation. ### Source excerpt With 2018 coming to a close, we thought it a good opportunity to once again reflect on our Bug Bounty program. At Shopify, our bounty program complements our security strategy and allows us to leverage a community of thousands of researchers who help secure our platform and create a better Shopify user experience. This was the fifth year we operated a bug bounty program, the third on HackerOne and our most successful to date (you can read about last year's results here). ## Solidity Bugfix Release DevFeed: [Solidity Bugfix Release]() Original publisher: [Read original article]() Author: Solidity Team Published: 2018-09-13T00:00:00Z Content type: release Language: en Sources: [Ethereum Foundation Blog]() Topics: [Solidity](), [Vulnerabilities](), [Ethereum](), [toolchain]() Tags: [bounty](), [bug](), [code](), [compiler](), [ethereum](), [release](), [research-development]() ### AI overview Solidity 0.4.25 fixes two important bugs, including incorrect results from certain exponentiation operations involving short integer types. Solidity 0.4.22 previously fixed a separate bug that can cause memory corruption when functions return multidimensional fixed-size arrays. ### Source excerpt The latest version 0.4.25 release of Solidity fixes two important bugs. Another important bug has already been fixed in version 0.4.22 but it was only discovered recently that the bug existed. Note that the Ethereum Foundation runs a bounty program for the code generator part of Solidity.... ## A Possible Solution To The Open Source Funding Problem DevFeed: [A Possible Solution To The Open Source Funding Problem]() Original publisher: [Read original article]() Author: Bruce Eckel Published: 2017-09-11T00:00:00Z Content type: opinion Language: en Sources: [Bruce Eckel - Computing Thoughts]() Topics: [Open Source](), [Software]() Tags: [bounty](), [open-source](), [open-source-software](), [projects](), [strategies]() ### AI overview The article discusses the open-source funding problem and considers bounty-based approaches as a possible partial solution. It argues that enabling people to get paid for developing open-source software is important to the future of the field. ### Source excerpt William Gross has posted Give Away Your Code, But Never Your Time, a potential and/or partial solution to the problem of funding open source projects, which I offered a solution for here. I've since heard from people pointing out projects that have actually used the "bounty" approach - I was unintentionally describing something that already exists. We've been solving all these other problems around open source, but not the essential one: how can people get paid for developing open-source software. ## Solidity optimizer bug DevFeed: [Solidity optimizer bug]() Original publisher: [Read original article]() Author: Martin Swende Published: 2017-05-03T15:21:57Z Content type: article Language: en Sources: [Ethereum Foundation Blog]() Topics: [bug](), [Solidity](), [Vulnerabilities](), [Bug Bounty](), [Ethereum]() Tags: [2017](), [analysis](), [blockchain](), [bounty](), [bug](), [code](), [release](), [research-development](), [vulnerabilities]() ### AI overview The article describes a Solidity optimizer bug affecting bytecode constants. The bug could generate routines that failed to recreate the original constant under specific conditions, and it was patched in Solidity 0.4.11 on 2017-05-03. The article notes that static analysis found no occurrence in deployed contract code, while cautioning that this does not guarantee none exist. ### Source excerpt A bug in the Solidity optimizer was reported through the Ethereum Foundation Bounty program, by Christoph Jentzsch. This bug is patched as of 2017-05-03, with the release of Solidity 0.4.11.... ## Security Alert - Mist can be vulnerable when navigating to malicious DApps DevFeed: [Security Alert - Mist can be vulnerable when navigating to malicious DApps]() Original publisher: [Read original article]() Author: Fabian Vogelsteller Published: 2016-10-27T11:12:05Z Content type: news Language: en Sources: [Ethereum Foundation Blog]() Topics: [Vulnerabilities](), [Security](), [Filesystems](), [browser](), [Ethereum]() Tags: [apis](), [bounty](), [browser](), [ethereum](), [files](), [security](), [upgrade](), [vulnerabilities]() ### AI overview A security alert reports that Mist versions 0.8.6 and lower exposed low-level APIs that malicious DApps or webpages could use to access the computer's filesystem, delete files, launch protocol handlers, and obtain sensitive information. Users are advised to upgrade Mist and avoid untrusted webpages. Ethereum Wallet is not affected because it cannot load external DApps. ### Source excerpt Mist leaks some low level APIs, which Dapps could use to gain access to the computer's file system and read/delete files. This would only affect you if you navigate to an untrusted Dapp that knows about these vulnerabilities and specifically tries to attack users. Upgrading Mist is highly recommended to prevent exposure... ## A Model To Fund Open-Source Projects DevFeed: [A Model To Fund Open-Source Projects]() Original publisher: [Read original article]() Author: Bruce Eckel Published: 2016-06-20T00:00:00Z Content type: opinion Language: en Sources: [Bruce Eckel - Computing Thoughts]() Topics: [Open Source](), [releases]() Tags: [bounty](), [business](), [funding](), [open-source](), [releases]() ### AI overview The article proposes funding open-source projects through release bounties: users who need the newest release pay toward a set bounty, while previous releases remain free. Once the bounty is met, the new release becomes free. ### Source excerpt Synopsis Place a bounty on the next release of an open-source project. Until the bounty is met, those who need/want the newest release must pay an amount in order to get it. Previous releases remain free. Once the bounty is met, the new release becomes free. The Problem of Funding I think open-source is one of the most important cultural and business innovations produced (so far) by the computing and network revolution. [Next page]()