80 engineers, 150 deploys every week, sometimes several hundreds of AWS instances. In a startup environment maintaining a high level of security is a challenging task. Concepts, codebase and infrastructure are changing rapidly. We trust our fellow engineers, the languages they choose and the machines they fire up at their will. Fear of making mistakes can squash innovation and creativity. With that in mind we are continuously developing automated tools which detect risky changes without blocking anyone but make it possible to react quickly. We will go into details describing our methods and tools to detect changes which might lead to security issues. Be this change in our AWS infrastructure, in our codebase or at the OS level. Apart from the automated tools, we try to find other scalable ways of detecting issues. This is one of the main reasons we have launched our bug bounty program six months ago. The 100 submissions we got every month in average is a great indicator where we should improve the most. Besides fixing the issue itself we can use them as vulnerability patterns for our tools. This way we try to make sure that we are learning from our mistakes and we catch similar issues in the future as soon as possible. We would like to share our learnings – both personal and professional – which can be useful for other companies thinking about starting a bug bounty program. All in all we believe we are not the only ones facing similar challenges, so we would like to share our experience. Presentation language: English