Twitter has announced it will begin paying for newly-found vulnerabilities under a bug bounty that has quietly run since June.
The program, launched through third-party bounty outfit HackerOne, has so far garnered 44 reports, none of which were eligible for payments since they were submitted prior to today.
Twitter says it is lucky to have security researchers willing to hack it and "To recognise their efforts and the important role they play in keeping Twitter safe for everyone we offer a bounty for reporting certain qualifying security vulnerabilities."
The avian network has not set a maximum payment for bug bounties but its minimum is a measly US$140, a value normally reserved to reward users who spotted typos or the accidental use of Comic Sans in graphical interfaces.
By way of comparison, Google recently paid out $30,000 to one enterprising hacker who chained together a series of vulnerabilities to pop out of Chrome's sandbox.
Twitter won't say if it will pay similar sums, but has said it will write cheques for a "design or implementation issue that is reproducible and substantially affects the security of Twitter users". Eligible bugs include cross site scripting messes, cross site request forgery; remote code execution and unauthorised access to protected tweets or direct messages. ®