Bug bounty triage and detection for a video platform
A public bug bounty program and a production platform that cannot afford downtime. The work was making both of them reliable: real findings escalated fast, noise kept out, fixes verified before closure.
- Client
- A high-traffic video platform
- Sector
- Consumer video at scale
- Engagement
- Embedded SOC engineering
- Timeline
- Ongoing
The platform runs video, a CDN, a live-streaming product and a cloud offering, with a public bounty program on top. Submissions arrive faster than a product team can validate them, and every invalid escalation costs engineering time.
Detection had the opposite problem. A high-traffic environment produces enormous log volume, so the useful signal is easy to lose in test-environment noise.
- 01
Reproduce before believing
Every submission was reproduced against current production behaviour before it moved. Accepted, duplicate or not-applicable, each decision came with a reason the researcher could read.
- 02
Score it consistently
CVSS vectors were assigned and documented, so severity did not depend on who triaged the report or how strongly it was argued.
- 03
Escalate with evidence
Engineering received tickets with reproduction steps, affected endpoints and a suggested direction, not a screenshot and a severity word.
- 04
Watch the platform
Wazuh monitoring and alerting ran alongside Zabbix. Alerts were triaged to separate real infrastructure issues from environment noise, and fixes were verified after deployment.
Tell me what yours looks like.
A short note about the system and the trigger is enough to say whether this pattern applies, and what a sensible scope would be.
Typically replies within one business day. NDA on request.
hello@enesismaili.com