Vulnerability Research Follows the Bounty Not the Risk

# Vulnerability Research Follows the Bounty Not the Risk ## Claim Security researchers spend their hours where a report gets paid and credited, so the software with no bounty behind it draws the fewest reports even when it carries the most exposure.  ## Scope & conditions - Holds while finding and writing up a vulnerability costs the researcher real time. Hubbard's 2026-10-08 email says AI "collapsed the cost of finding" bugs; if that cost nears zero, volume may spread to unfunded targets anyway. - Applies to researchers who report for income or reputation. Volunteers, academics and maintainers auditing their own code follow other incentives. - Doesn't say funded software is safer. More reports on a funded target can mean more found bugs, not fewer present ones. - For WordPress the split runs core versus plugins: core has paid bounties through HackerOne since April 2017, and most plugins have none unless an ecosystem program like Patchstack's covers them. ## Evidence Sybre Waaijer, X 2026-10-08: "the most impactful vulnerable piece of software is the unfunded one, and it's unattractive to even report vulnerabilities for it." Context from The Repository (Rae Morey, 2026-10-08): core HackerOne reports rose from a 20–30/month baseline to 773 in August 2026 with bounty payouts above $90,000 in 90 days, and Patchstack says it paid $600,000 in plugin bounties since 2022 out of its own pocket. ## Links - [[3. Resources/Permanent Notes/In-Kind Labor Hides How Dependent a Commons Is on a Single Backer]] — because extends: one backer paying every core bounty decides where research attention lands, not only who carries the cost - [[3. Resources/Permanent Notes/An Open Marketplace Turns Extensibility Into Liability Without an Owned Security Layer]] — because evidence-for: the plugin directory is the unfunded surface researchers skip - [[3. Resources/Permanent Notes/A Security Commons Grows When the Cost of Not Joining Is Visible]] — because applies-in: a pooled bounty fund is the commons that would move research toward unfunded plugins - [[3. Resources/Permanent Notes/Open Scrutiny Functions as a Security Mechanism Not a PR Cost]] — because contrasts: open code permits scrutiny, but this note says money decides whether the scrutiny happens - [[3. Resources/MOCs/Open Source Governance MOC]] — because applies-in: security funding as a governance question ## Tests / falsifiers - Compare public CVE counts per active install for WordPress plugins inside versus outside a paid bounty program over the same 12 months. - Falsified if plugins with no bounty coverage draw reports at the same rate per install as covered ones. ## Maintenance - Last tended: 2026-10-09 - Next review: 2027-01-09 ## Source - [[3. Resources/Literature Notes/They Should Consider Their WPScan Data — Sybre Waaijer (X, 2026-10-08)]]