We're a reference website. Our revenue comes from ads. 98% of traffic is anonymous, mostly from Google. Hardly anyone creates an account. We collect no sensitive information -- no CCs, only email, password, and optionally gender, birthday, bio, website. An account gets you access to our daily email and a user forum. Admin accounts can moderate the forum and edit a limited selection of ancillary content on the site. The real content is accessed through a separate account system.
Our engineering team is 4 people, none of whom are security experts. We've followed best practices as far as we know them. Never done a pen test or audit.
We offered $100, based on https://forum.bugcrowd.com/t/payouts-whats-a-bug-actually-worth-these-days/399/7
He responded with these prices:
- account takeover $1000
- sql injection $3500
- remote code execution $5000
So a big difference in prices. Also, I'm much more concerned about SQL injection and remote execution (which he did not initially mention) because they could to outages, which would be more costly to us than compromised accounts.
My thinking is to ask him what vulnerabilities he has found, so we can know what we might be paying. If it's just one account takeover, I'd probably then see if he'll take $500, or if not, give him the $1000.
He said he would be willing to share the exploit first and take our word that we will then pay him, which helps me trust him, though then I started to wonder if that's his intent and all of this is mind games intended to draw us deeper into some kind of extortion trap...so that's why I'm looking for guidance. Are there hidden dangers here? Should we cut off further contact and hire a reputable security firm to audit us? Or can I proceed based on my own/my teammates' judgment?