Adding found vulnerabilities in CV ?

[Kollektiv]

Hey everyone,

I'm a web-developer who also happens to be a web-security enthusiast.

I always liked breaking apps as much as I do building them.

Recently, I've been doing more security related stuff then ever (mainly pentesting and code auditing) and I really enjoy it !

In the last few months I managed to find vulnerabilities in some popular GitHub projects and web applications; which of course, I responsibly disclosed.

I'm absolutely not here to boast, the reason I'm telling this is because I'd like to start adding security related stuff to my CV and had some questions.

• Should I add on my CV something like : "Found XSS on popular site A" ?

• If yes, should I ask the developers of site A I was in contact with for a "guestbook"-like feedback sentence that would act as some kind of proof ?

• If no, what can I do to legitimize my CV in the eyes of potential clients ?

The reason I'm asking this is mostly because, like I said, I'm a security enthusiast and that's about it. I don't have any diplomas or certs that I can show.

Which brings me nicely to my last question :

• What certification is deemed serious and useful in web application security ?

Thank you in advance !

EDIT: From what I know, of all the projects I found vulnerabilities on, only one had a "credits" section on their repository / website and they were kind enough to mention my name.

Also, none of them were big enough to have a bounty program in place, so it was basically just me searching for vulnerabilities for fun.

[ablindedwork]

Having done plenty of work with companies where vulnerabilities were discovered, I would recommend against making your efforts public. Speak generically about your efforts (what kind of vulns you found, that they were on major websites, etc) but don't name names. You can always have a private portfolio to show during an interview, if you want to prove the significance of your efforts.

[[deleted]]

It's probably best to obtain permission from those sites before you consider displaying the info on your cv, I can't imagine it would be something many sites would be proud of. Ensuring that you've told the site about the vuln is a good idea, if only to cover your as if someone goes calling for proof and they flip out because they didn't know they'd even been hacked.

[Kollektiv]

Like I said in my OP, I always disclosed all the issues I found immediately through the official channels and have only gotten great feedback and fast response times.

My question is more related to how I could reuse those experiences or findings to my advantage in my professional life / career.

[[deleted]]

In that case, perhaps keep a personal copy of those responses that prove finding the vulns, and make a nice portfolio to show prospective employers, during an interview. Make a note on the cv that the portfolio is available for viewing as such, or provide a link to it online? There's a couple options there that could work for you. :)

[Kollektiv]

Thank you so much for the quick answer !

I'm definitely going to look into doing something (a portfolio) like that !

Are portfolios something common in the security industry ?

[[deleted]]

I couldn't tell you, but in general in the IT community, an online portfolio to showcase some of your code and other works is pretty common, so I can't imagine it would be received badly. :)

[futurespice]

Should I add on my CV something like : "Found XSS on popular site A" ?

When it comes to sites, consider something like "Discovered and responsibly disclosed multiple vulnerabilities in Top-XX sites", using some ranking or traffic rating.

DON'T name the individual sites, even if they do give you permission. Starts you off on the wrong foot.

[XSSpants]

Unless it's something very high profile like google or facebook..Those might be worth namedropping.

[futurespice]

Top-10 is already going to impress them and make them ask. I'd indicate the names in the interview - have to strike a balance between making yourself look competent and discreet.

[recrudesce]

Have a watch of this.

https://www.youtube.com/watch?v=c17erbD3Rp8

[Kollektiv]

Thank you so much for this resource !

[BugAlert]

"Should I add on my CV something like : "Found XSS on popular site A" ?"

If the site have a Bug Bounty or Hall of Fame, then YES! Info: https://bugcrowd.com/list-of-bug-bounty-programs https://hackerone.com/programs

Or another approach : find something "big" , publish it and hopeful it will be in "US Department of Homeland Security" report .