The online money transfer service's CISO, Michael Barrett, said he initially had mixed thoughts about implementing a rewards program, but data has backed up its effectiveness. PayPal will pay for bugs that fall into four categories: cross-site scripting, cross-site request forgery, SQL injection and authentication bypass.
The compensation will be based on severity, but specific criteria was not provided.
Vendor bounty programs began regularly popping up several years ago -- Mozilla launched one in 2004 -- but industry pros have disagreed on their worthiness. Microsoft, for example, doesn't pay for flaw finds. Instead, it believes crediting researchers for their discoveries can go a long way to helping their careers.