“For us, bug bounty was really complementary to other security tests and it brought its own added value. It allowed us to discover several vulnerabilities, which had not been seen before in the application. That being said, the vulnerabilities were neither numerous nor critical, which shows that we had done …

“We’ve done a lot of pentests, we always do some for compliance or to get back on critical applications. But with bug bounty, it’s different. You’re not waiting for a report, you’re waiting for a critical vulnerability. That’s the difference as well. And with Yogosha, criticals have almost always been …