“Red Soft” summarized the results of the first stage of the vulnerability bounty program in the “Red Database” database management system (DBMS). Over the year, independent researchers submitted 144 reports, 75 of which were confirmed and accepted for work. The total amount of rewards to participants exceeded 3 million rubles.
The testing took place on the Standoff Bug Bounty platform: the program operated in private mode for 11 months, and for another month in public mode. Of the 75 confirmed vulnerabilities, five were classified as critical severity, 40 as high, 15 as medium, and 15 as low. Another 42 reports were rejected because the issues were not confirmed or did not meet the program's terms, and 27 turned out to be duplicates.
The total payout fund amounted to 3.01 million rubles. The researcher under the pseudonym Bearsec earned the most — his reward reached 1.33 million rubles.
According to the company, the identified issues are being fixed both in the “Red Database” core and in Firebird. The program will continue, and the acceptance of new reports remains open.
“Red Database” is certified by the FSTEK of Russia according to the 4th security class and the 4th trust level. The system provides, in particular, data encryption according to GOST, multi-factor authentication, and SQL injection protection mechanisms.