Notes on hiring, security, and how we build Kit.
CRA reporting starts on 11 September 2026 for manufacturers in scope. The main obligations, including coordinated vulnerability disclosure, apply from 11 December 2027.
curl, HackerOne, and Nextcloud all buckled under AI-generated bug bounty slop in 2026. Here's the triage playbook that keeps a VDP alive under volume.
The North Korean IT worker scheme nets an estimated $250M-$600M a year by placing fake remote hires inside U.S. companies. Here's how to catch them at intake.
Researchers don't drop zero-days because they're hostile. They publish after slow acks, silent fixes, and severity downgrades. Keep them coordinating with you.
Connect hiring, training, and access records so your team can reconstruct onboarding during a SOC 2 examination.
77% of bug bounty programs ran a VDP first. One engineer can stand up the intake in a week: scope, security.txt, safe harbor, and triage SLAs.
Displaying items 28-33 of 33 in total