Grab Celebrates 5 Years on HackerOne

Grab’s security team describes the evolution of their bug bounty program—from a private initiative to a public HackerOne program—highlighting operational lessons: fast first-response times, paying full bounties after triage (average time-to-bounty of 5 days), using HackerOne Triage and Human‑Augmented Signal to reduce noise, and instituting team scheduling with API/PagerDuty integrations. The program engaged over 200 researchers, resolved ~450 valid vulnerabilities, and improved security by integrating bug bounty findings into development workflows.