Bug Bounty

# Bug bounty - inside view + ethical participation

> Bug bounty programmes are voluntary, scoped, paid disclosure programmes.
> Always operate within scope; out-of-scope activity is illegal and can
> destroy your career.

## Why companies run bounties

- Continuous coverage that internal teams cannot match
- Diverse perspectives find things a tired internal team misses
- Cheaper than not knowing about issues
- Goodwill with the security community

## Programme types

- Public (open to everyone, e.g. HackerOne public programmes)
- Private (invite-only - earned reputation; usually higher quality)
- Crowdsourced pen tests (time-boxed, paid even without findings)
- VDP (Vulnerability Disclosure Programme) - no payouts, just legal safe harbour

## Scope discipline (the most important rule)

- Read the scope page first AND last - it is a legal contract
- Out-of-scope assets are not 'free hunts'; they can be illegal
- Out-of-scope methodology (e.g. DoS, social engineering against staff) is forbidden
- Test accounts ONLY use the credentials the programme issues

## Reporting that gets paid

- Clear, reproducible steps
- Impact statement tied to the product's risk model
- Suggested mitigation when you can offer one
- Screenshots and HTTP transcripts; not videos by default
- One issue per report; do not pile

## Defender view (what the security team is doing)

- Triage SLA (usually 24-72 hrs)
- Severity scoring (often CVSS + business impact)
- Reproduction in an isolated environment
- Routing to engineering with SLAs by severity
- Public summary + payout once fixed (sometimes)

## Common ethical issues

- Researchers testing past the disclosed scope
- Programmes that ghost reports - bad for both sides
- 'Bounty trolling' - low-quality scanner output without analysis
- Coercive disclosure threats

## How to grow as a researcher

- Pick one product class (auth, payments, cloud); go deep
- Read public reports daily
- Document your methodology, including dead ends
- Build relationships with programme managers (be professional)
- Move from public to private invite-only over time

# Read scope CAREFULLY. Stay in scope.
# Track artifacts, write reproducible reports, redact PII.
# Programs: HackerOne, Bugcrowd, Intigriti, Google VRP, Apple Security Bounty.