Bug bounty

A bug bounty is a standing program in which an organization pays independent security researchers — ethical hackers — for responsibly disclosed vulnerabilities found in its applications, infrastructure or devices. The economics are straightforward: paying a friendly researcher for a flaw is vastly cheaper than the breach that follows a criminal finding it first. Netscape ran the first program in the 1990s; today bounties are operated by tech giants and mid-size companies alike, either in-house or through platforms such as HackerOne, Bugcrowd and Intigriti.

How a bug bounty program works

Everything hangs on the published policy, which defines:

• scope — which domains, apps and systems may be tested, and what is explicitly off-limits,
• rules of engagement — no data exfiltration, no social engineering, no denial-of-service, confidentiality until the fix ships,
• reward tiers — payouts scaled by severity (commonly CVSS-based), from token sums for minor issues to six-figure rewards for critical remote-code-execution bugs at the largest programs,
• reporting requirements — reproduction steps and a working proof of concept.

Submissions go through triage: validation and deduplication (only the first reporter of a given bug is paid), then remediation, payout and often a public hall-of-fame credit. Programs can be public or invitation-only, and many organizations start with a plain vulnerability disclosure policy — a safe reporting channel advertised via security.txt, without guaranteed rewards.

Practical use

A bounty complements rather than replaces penetration testing: a pentest buys systematic coverage on a schedule, while a bounty buys continuous scrutiny from thousands of specialists with different toolkits. The findings skew toward the OWASP Top 10 — cross-site scripting, broken access control (IDOR), injection flaws and SSRF dominate platform statistics.

For a company, the prerequisite is maturity: a responsive triage process, a realistic reward budget and the engineering capacity to fix what gets reported — an ignored inbox burns researcher goodwill fast. For researchers, bounty hunting has become a genuine career path, with the top hunters earning a full-time living from rewards alone.