{"id":64843,"date":"2022-10-20T08:00:00","date_gmt":"2022-10-20T15:00:00","guid":{"rendered":"https:\/\/www.salesforce.com\/?p=64843"},"modified":"2022-11-17T16:53:38","modified_gmt":"2022-11-18T00:53:38","slug":"salesforce-bug-bounty-program-swinnen","status":"publish","type":"post","link":"https:\/\/www.salesforce.com\/uk\/news\/stories\/salesforce-bug-bounty-program-swinnen\/","title":{"rendered":"“It’s Not About a Paycheck, But a Purpose”: Bug Bounty Hunter Reveals Why He Hacks for Good"},"content":{"rendered":"\n

Arne Swinnen is a pretty typical guy; he enjoys playing soccer, swimming, and cycling. Based in Belgium, he recently taught his 4-year-old son how to ride a bike and his 1-year-old daughter how to take her first (baby) steps. <\/p>\n\n\n\n

Swinnen is also one of Salesforce\u2019s most active hackers.<\/p>\n\n\n\n

Not in the way you might think, however. While pop culture often casts hackers as \u201cbad guys,\u201d many of the world\u2019s top companies<\/a>, including Salesforce<\/a>, now enlist ethical hackers to help identify and fix security vulnerabilities. <\/p>\n\n\n\n

In fact, bug bounty programs<\/a> are an important part of managing security bugs<\/a> and surfacing potential issues to help companies like Salesforce keep customer data secure. In 2021 alone, Salesforce rewarded over $2.8 million in bounties to ethical hackers<\/a> who submitted more than 4,700 reports of suspected vulnerabilities.<\/p>\n\n\n\n

We sat down with Swinnen to learn more about his hacking experience, what motivates him, and the advice he has for other ethical hackers.<\/p>\n\n\n\n

Q: What sparked your interest in hacking?<\/h2>\n\n\n\n

I\u2019ve been hacking for over 10 years. I was initially exposed to hacking during my computer science studies in college. Then in my master\u2019s program for securing software, I participated in a virtual capture-the-flag team where we competed against other universities. That experience was the start of my love for trying to find loopholes in software.<\/p>\n\n\n\n

Bug bounties were only in their inception phase after I graduated, but I soon discovered the flexibility that the lifestyle provided for me over other jobs, and decided that was what I wanted to do for a living. I\u2019m now a full-time bug bounty hunter.<\/p>\n\n\n\n

Q: How did you get involved in bug bounty programs?<\/h2>\n\n\n\n

I appreciate the technical and intellectual challenges inherent to bug bounty hunting. It\u2019s encouraging to know that my work and discoveries could help prevent a breach or tech issues that could negatively affect millions of users. It adds a whole new dimension to the impact of my efforts \u2014 it\u2019s not about a paycheck, but a purpose.<\/p>\n\n\n\n

Q: Why do you choose to work on Salesforce\u2019s bug bounty program?<\/h2>\n\n\n\n

There are millions of programs out there, but Salesforce is one of my favorites \u2014 it\u2019s actually my main program \u2014 and in my opinion, one of the most mature programs out there. There\u2019s a mutual level of trust and transparency with the Salesforce Bug Bounty Team.<\/p>\n\n\n\n

Most importantly, the Team is receptive and appreciative of my findings. They respond quickly to my reports and have a dedicated Triage Team with a deep understanding of complex bugs and esoteric functionalities, which sets Salesforce apart from other bug bounty programs I\u2019ve worked on.<\/p>\n\n\n\n

Additionally, Salesforce is really investing in their Bug Bounty Program \u2014 they rigorously add scope to the program, which continually makes it an interesting program for me to devote time to. They also run regular promotions, and when there\u2019s a big <\/em>promotion, I can\u2019t stop thinking about it.<\/p>\n\n\n\n

Q: What advice would you give to someone just beginning their journey within a bug bounty program?<\/h2>\n\n\n\n

As a starting point, you don\u2019t have to look for critical issues, but look for anything you think is a bug and submit it. Salesforce, for example, is very risk aware, so if it\u2019s a very minor but valid issue, you\u2019ll be recognized by the team. <\/p>\n\n\n\n

Once you build up your credibility and submit enough valid reports to the team over time, you may be invited to their VIP program, where you\u2019ll have exclusive access to new scope, promotions, and significant payouts.<\/p>\n\n\n\n

The ability to find and fix vulnerabilities before products are rolled out to users is core to Salesforce\u2019s broader security initiatives and helps maintain trust among its customers, partners, and ecosystem. Salesforce continuously evolves its bug bounty program, engaging with ethical hackers to protect the company\u2019s growing product portfolio, and continuing to facilitate hacker-powered testing of many products even earlier in their development cycles.<\/em><\/p>\n\n\n\n

Explore further<\/h3>\n\n\n\n