Netscape Offered Cash Rewards for Bugs to Fix Browser Flaws

The Origins of Crowdsourced Security

Before software vulnerability rewards became an established industry practice, organizations relied almost exclusively on internal quality assurance teams and contracted security auditors to evaluate their code. This closed model assumed that a finite group of vetted engineers could anticipate every possible flaw in an increasingly complex codebase. However, as software systems scaled and networked environments emerged, the sheer surface area for potential security vulnerabilities expanded far beyond what internal teams could realistically review.

Early precursors to modern bounty programs proved that external testers could uncover issues that internal developers missed. In 1983, the operating system company Hunter and Ready launched an unconventional campaign offering a Volkswagen Beetle to anyone who discovered a bug in their Versatile Real-Time Executive operating system. While that campaign was an early marketing and testing experiment, the concept of systematically compensating third-party researchers for security disclosures did not formally enter the internet software industry until over a decade later.

Netscape's 1995 Experiment

In the autumn of 1995, Netscape Communications Corporation found itself at the center of the burgeoning World Wide Web with its flagship product, Netscape Navigator. As the browser's popularity exploded, technical support engineer Jarrett Ridlinghafer noticed an unusual pattern among early adopters: enthusiastic power users and independent developers were routinely probing Netscape Navigator 2.0 Beta, discovering software defects, and posting workarounds or reports independently.