White Hat

For enterprises, the white hat community is equivalent to an external security testing force distributed around the world, able to discover and help fix hidden risks before attackers do.

White hats are technical personnel who possess penetration testing and vulnerability discovery skills but, after discovering vulnerabilities, choose to report them to companies rather than exploit them maliciously.

White hats' sources of income usually include vulnerability bounties paid by corporate SRCs, project compensation from crowdsourced testing platforms, and formal positions at security vendors.

In the SRC context, the testing scope description published by the company and the written authorization email are the prerequisite basis for all testing behavior carried out by white hats.

White hats' confidentiality obligation requires that after submitting a vulnerability report and before the vulnerability is fixed, it is strictly forbidden to disclose vulnerability details.

SRC has built a closed loop of discovering vulnerabilities, reporting vulnerabilities, and fixing vulnerabilities, while also providing white-hat hackers with a legal channel for monetization.

Those working in cybersecurity in China should label themselves as white-hat rather than grey-hat hackers, as grey-hat hackers constantly face the legal risk of being summoned for questioning and investigation.

The difference between white-hat hackers and hackers lies not in technical ability, but in purpose and the boundaries of authorization.

SRC（安全应急响应中心）是企业设立的漏洞收集平台，企业付费购买未公开的安全漏洞，安全研究者发现并提交后审核通过可获得赏金