Versions Compared


  • This line was added.
  • This line was removed.
  • Formatting was changed.


  • Recognition – Public recognition is often used as a reward for "playing by the rules" in CVD.
  • Gifts – Small gifts (or "swag") such as T-shirts, stickers, and so forth give researchers a good feeling about the organization.
  • Money – Bug bounties can turn CVD into piece work.
  • Employment – We have observed cases where organizations choose to hire the researchers who report vulnerabilities to them, either on a temporary (contract) or full-time basis. This is of course neither required nor expected, but having a reputation of doing so can be an effective way for a vendor to encourage positive interactions.


< 2.3. Avoid Surprise | 2.5. Ethical Considerations >