PayPal to offer payment for finding security bugs

PayPal has joined the likes of Google and Facebook by announcing Thursday that it will begin paying researchers who discover vulnerabilities on its website.

The online money transfer service's CISO, Michael Barrett, said he initially had mixed thoughts about implementing a rewards program, but data has backed up its effectiveness. PayPal will pay for bugs that fall into four categories: cross-site scripting, cross-site request forgery, SQL injection and authentication bypass.

The compensation will be based on severity, but specific criteria was not provided.

Vendor bounty programs began regularly popping up several years ago -- Mozilla launched one in 2004 -- but industry pros have disagreed on their worthiness. Microsoft, for example, doesn't pay for flaw finds. Instead, it believes crediting researchers for their discoveries can go a long way to helping their careers.