Bug bounty program
Also known as: bug bounty, bug bounties, vulnerability reward program, bounty program
A bug bounty program is an arrangement where an organization invites independent security researchers to find and report vulnerabilities in its software, apps, or websites, and pays rewards for valid findings.
Programs set rules about what can be tested and how to report safely. While bug bounties tap a huge pool of talent and often find issues internal teams miss, they can flood teams with low-quality reports and don't replace a basic security program.
Bug bounty program, explained at three levels
At home
A bug bounty is like a reward poster for security flaws. A company publishes rules saying what you may test and how to report, and anyone who finds a real problem and reports it privately gets paid. The company fixes the flaw before it becomes public, so honest hackers earn money instead of legal trouble, and criminals lose the chance to find it first.
At work
A bug bounty program is an open invitation for outside security researchers to look for flaws in a company's apps or websites under published rules. Researchers report what they find privately, the company confirms and fixes each issue, and it pays only for valid findings. Businesses use bounties to get many skilled testers looking at their systems without paying for hours that find nothing.
At home
A bug bounty turns outside hackers into paid testers under clear rules. The company publishes a policy listing what may be tested, which techniques are banned, how to report findings and what each severity pays. A researcher finds a flaw, sends a report with proof, and the company's team checks it, confirms the severity and fixes it. Only then is the reward paid, and the details are usually kept private until the fix is out.
At work
Most programmes run through platforms such as HackerOne, Bugcrowd or Intigriti, which handle researcher identity, payments and first-pass triage. Programmes can be private, open only to invited researchers, or public. Rewards are set by a severity table, often based on CVSS, and duplicates usually earn nothing because only the first report counts. The safe harbour clause in the policy is a promise that the company will not pursue legal action for good-faith testing that stays within scope.
At home
While a bounty sounds like an open invitation, the permission only covers what the policy says. Testing outside the listed scope, accessing other people's data, or demanding payment before disclosing a flaw can turn research into a crime or extortion. Companies without a programme may still have a vulnerability disclosure policy, which offers a safe way to report but no payment. In my view, reading the policy first is not optional; it is the line that keeps you on the right side of the law.
At work
A bounty only works on top of a mature fixing process. Without one, a flood of reports overwhelms engineers, and payouts go to low-value findings that scanners could have caught. Most organizations start with a vulnerability disclosure policy, often published through a security.txt file on their website, then move to a private bounty before going public. Watch triage time, time to fix, duplicate rates and repeat bug classes, since recurring classes point to root causes worth fixing in code rather than paying for repeatedly.
Real-world examples
At home
Aisha, a self-taught security researcher in Edmonton, earned her first bug bounty after reporting a flaw that let users view other people's order details on a retailer's website.
At work
Carlos runs product security at a Montreal software company. Launching a private bug bounty found three serious issues in the first month that years of internal testing had missed.
How it compares
| feature | Bug bounty program | Penetration testing |
|---|---|---|
| Who tests | Many outside researchers | A hired team |
| Payment | Per valid finding | Fixed fee |
| Timing | Ongoing | Scheduled period |
| Coverage | Broad but uneven | Defined scope, thorough |
Bounties bring many eyes over time. Pen tests bring focused depth.
For analysts
I'd publish a vulnerability disclosure policy before launching any bounty. It's free, it gives researchers a safe way to report, and it builds the process a bounty program needs.
History & origin
Netscape launched one of the first bug bounty programs in 1995, offering rewards for flaws in its Navigator browser. Mozilla started its program in 2004, and Google began its Vulnerability Reward Program in 2010, followed by Facebook in 2011. Platforms such as HackerOne and Bugcrowd, both founded in 2012, made it easy for companies to run programs. The US Department of Defense ran 'Hack the Pentagon' in 2016, showing governments could benefit too. Top researchers now earn substantial incomes, and large companies pay out millions of dollars a year. Vulnerability disclosure policies, a lighter version without rewards, also became widespread. In my view, bug bounties are one of the best examples of turning potential adversaries into allies.