Scaling & Prioritizing Product Security with Zendesk

Zendesk's Senior Manager of Product Security outlines the company's five-year bug bounty program on HackerOne, explaining its evolution from a responsible disclosure process, methods for scaling security (the "golden path", triage services, automation), and key metrics such as SLA-driven vulnerability remediation times. The piece offers operational advice—start private, ensure vulnerability management and developer tooling—and highlights a notable SSRF report that was escalated by a researcher to remote code execution, underscoring positive researcher engagement and program value.