Bale Pays 1.7 Billion Toman in Its Second Bug Bounty Program

The second Bale bug bounty program concluded with 132 vulnerability reports filed and 1.71 billion toman in rewards paid. The post Bale Pays 1.7 Billion Toman in Its Second Bug Bounty Program appeared first on Safir Arjan.

The second Bugbunty Blue ended with the registration of 132 vulnerability reports and the payment of 1.71 billion Tomans.

Become a special member of Arjan Ambassador in order to benefit from and access special facilities and different departments in Arjan Ambassador.

In the second round of its Bugbunty event, Blue declared 19 reports eligible to receive awards out of 132 vulnerability reports, and a total of 1.710 billion Tomans was considered as a reward. At the end of this event, Blue executives talked about the program to expand the Bugbundy domain, and the security panel in the era of artificial intelligence also addressed issues such as the resilience of banking services and the cancellation of international certificates.

The second round of Bugbunty Blu event titled "blu Deep Dive 2026" has ended with 132 vulnerability reports being registered and awarding to 19 reports. In this period, after holding the Conquest of the Flag (CTF) competition with the participation of 1465 people, 80 cyber security researchers were invited to participate in the Bugbunty program. The total rewards of this period were announced as one billion and 710 million tomans.

BugBunty is a program where companies allow cyber security professionals to audit their systems and infrastructure within a specified time frame and receive rewards for identifying and reporting vulnerabilities. By holding this event, Blue tries to extend the security evaluation of its products beyond the internal team and to involve the community of independent experts in this process.

According to the explanations presented at the closing ceremony, the first stage of this course started with the CTF competition in September. In this competition, participants would receive flags by solving security challenges.

Finally, 80 researchers were selected to attend the Bagbunti face-to-face event. According to the organizers, the selection of the teams was not based solely on the final ranking in the competition. The history of effective activity in the previous period and being known in the cyber security community also played a role in the selection of the invited teams.

During the face-to-face event, 132 reports about the vulnerabilities of the Blue application were registered, 19 of which were eligible to receive an award. Three teams were also announced as main winners and awarded for their important reports. The total prizes of this period were announced as one billion and 710 million tomans.

At the closing ceremony, Heidari, the CEO of Blue, pointed out that this collection was able to win the trust of 28 million people, and said that this number is not just a statistic and behind it is the trust and confidence of the users.

He considered security to be more than a temporary measure and emphasized: "Security is not a one-word issue; It is a process."

According to the CEO of Blue, the responsible discovery of vulnerabilities is part of the security process and the responsibility that this group has accepted. He also pointed to the continuous change of technology and emphasized the necessity of continuous attention to security.

Citing security reports, Heydari said that a significant part of data breach and hacking incidents are related to application vulnerabilities, and third parties are also involved in some of these incidents.

Referring to the global costs of vulnerability detection programs, he said that in the 2025 report of Hacker One, the figure of 81 million dollars was raised for this field. According to his belief, Bagbanti, in addition to its security function, is also economically valuable; Because it helps protect users and improve their experience.

Blue's CEO emphasized that the received reports should be reviewed and lead to practical measures to solve the problems. Customers don't see the vulnerability reports directly, he said, but the results of these actions can be seen in their confidence when using the app.

Heydari also announced that the path of Bugbunty Blue will continue and that the group wants to create a culture where reporting the existence of vulnerabilities does not cause concern about its costs.

Ghazanfari, a member of Blue's board of directors, pointed to the changes in traditional banking and said that the use of emerging technologies can make banking operations more agile and provide a better user experience to customers. At the same time, he considered maintaining users' trust as one of the requirements of this path.

Ghazanfari also emphasized the importance of preparation for developments in the field of quantum and post-quantum computing. According to him, Blue considers it necessary to formulate a strategy to face these changes; Because changes in this area can affect the current security mechanisms.

Blue board member, referring to the previous term of Bagbanti, said that at that time, the scope of the program was promised to go beyond the application, but the conditions of the country affected the implementation of this program.

He announced that Blue plans to expand the scope of Bugbunty to more parts of products and APIs; Including interfaces that are not public. The purpose of this development was to increase the resilience of the infrastructure and maintain the reliability of the platform.

During this conclusion, a panel titled "Security risks of using artificial intelligence in data protection to controlling autonomous agents" was held. Chief Security Officer of Blue and Tapsi and CEO of Kashif were among the attendees of the panel and it was moderated by Koresh Chaichi, Media Secretary of Ambassador Arjan.

Esmail Mullah Ahmadi, Chief Security Officer of Blue, referring to the experience of two rounds of Bug Bunty, said that this program has been effective in identifying some vulnerabilities and strengthening the security team. He emphasized that security requires a series of continuous measures and one cannot expect a single program to solve all problems.

According to Mulla Ahmadi, in the new era, Blue has focused on deepening the event instead of just expanding its dimensions. He also said that in the design phase of this year's competition, the idea of providing a platform for the presence of artificial intelligence agents (AI Agent) in the CTF competition was raised, and this group plans to launch such a competition in the future.

Blue's chief security officer also announced the preparation of a page for announcing vulnerability reports, which, according to him, has not yet been published due to the country's recent conditions.

Saeed Kazemi, the chief security manager of Topsy, said that instead of directly searching for the capabilities of an application, users may ask it to perform a specific task for them. In such a model, chatbots and intelligent agents can become part of the service delivery process.

Kazemi explained about the security considerations of these tools that the chatbot's access to information must be limited and controlled and can be limited to the same user's session. In response to a question about the possibility of the chatbots of this series being jailbroken, he said that no report has been received in this regard so far.

Referring to the use of artificial intelligence in the field of cyber attack and defense, Khodabakhshi, the CEO of Kashif, said that one of the most important challenges is to detect penetration and identify the scope of the attacker's activity. According to him, in some recent incidents in the country, the infiltration happened a few months before the final identification.

Emphasizing on changing the nature of cyber attacks, Khodabakhshi considered increasing resilience as one of the most important priorities. He explained that organizations should be able to first detect the occurrence of an attack, then limit the scope of destruction and finally restore their services to normal status in the shortest possible time.

CEO Kashif also said that in attacks on banking infrastructure, the goal is not always to directly withdraw money from the bank; Sometimes disabling services that people depend on can be the main goal. According to him, the level of security maturity in banking and payment is higher than in many other areas, but this does not eliminate the need to prepare for new threats.

One of the important topics raised in the panel was the SSL crisis and the challenge of using national certificates; The issue that started with Koresh Chaichi's question to the CEO of Kashif. Pointing to the decrease in public trust in the solutions that have the title of "native", Chaichi asked what actions can be taken in the situation when international certificates are canceled and is there a solution beyond informing users?

In response, Khodabakhshi said that about two months ago, the issuers of international certificates informed some Iranian collections that they are unable to provide services to parts of Iran's banking network, including Shoprak and banks, due to sanctions related to OFAC and the European Union.

He warned that this restriction may be extended to other Iranian websites with .ir and even .com domains. According to Khodabakhshi, this happened while the contracts for obtaining the certificate had not yet been completed. Following this situation, the groups involved turned to exporters in different countries, including Italy, Türkiye, and China, to obtain certificates; However, certificates are still revoked every few days.

Khodabakhshi said that several meetings have been held at the Central Bank, the National Center for Virtual Space, the government and other groups to examine the dimensions of this issue, and the current conclusion is to use the national certificate issued by the Iran Trade Development Center.

CEO Kashef divided the problems caused by this situation into two parts. Certificates used by applications, servers and web services and certificates that users encounter when they open websites in a browser. He said that the problem of the first part has been solved by using the national certificate, but in the browser part, there is still the issue of user trust.

According to him, two solutions have been proposed by the authorities, one of which is to launch a national browser. Opposing the launch of a national browser, Khodabakhshi said that convincing users to trust a new certificate through notification is easier than convincing them to change browsers.

He also claimed that the national certificate is no different from international certificates in terms of encryption algorithms and the mechanism of creating a secure meeting. Rather, the main difference is that the national certificate is not included in the list of certificates trusted by browsers and the user must confirm it in the first step.

In the end, CEO Kashef emphasized the need for transparent information and said that the whole story should be explained to the people from the beginning to the end, without censoring parts of it.

At the end of the ceremony, the winners of the Bug Bunty Blue event were honored.

I was an electrical student, I taught programming at the university, but eventually I became a journalist. The reason goes back to a repeated question from my fellow university student: "Why don't you write?". I am interested in reviewing financial statements and analyzing businesses.