What is a bug bounty program?
A bug bounty program invites independent security researchers to look for vulnerabilities in an organization's websites, apps or products and pays a reward for each valid, in-scope report. Payouts grow with severity, and when two researchers find the same flaw, the first valid submission typically collects. Some organizations run programs themselves; many use platforms such as HackerOne, Bugcrowd or Intigriti, which handle researcher identity, triage and payment. A program can be private, open only to invited researchers, or public. The U.S. Department of Defense's Hack the Pentagon program in 2016 was the first bug bounty run by the federal government.
What a program publishes
- Scope: which assets are in, such as the customer portal and mobile apps, and which are out, such as third-party services and the corporate network.
- Rules: forbidden activity, typically denial of service, social engineering, physical intrusion and accessing more data than needed to prove a flaw.
- Rewards: a severity scale, often based on CVSS, with payment ranges, and how duplicates are handled.
- Disclosure terms: details stay private until the flaw is fixed or the organization agrees to publication.
- Safe harbor: a commitment not to pursue legal claims against researchers who act in good faith and stay within the rules.
How a report is handled
- The researcher submits the flaw with reproduction steps and evidence.
- A triage team, in-house or from the platform, confirms it is real, in scope and not a duplicate, and rates its severity.
- The finding becomes a ticket for the owning team, with a deadline set by severity.
- After the fix, the team or the researcher retests to confirm it is closed.
- The reward is paid, and the details may be disclosed publicly by agreement.
Each valid report is also a clue: a SQL injection in one form suggests checking every other form built the same way.
Bug bounty vs. disclosure policy vs. penetration test
| Vulnerability disclosure policy | Bug bounty program | Penetration test | |
|---|---|---|---|
| Who tests | Anyone who happens to find a flaw | Many outside researchers | A contracted team |
| Payment | None | Per valid finding | A fee for the engagement |
| Timing | Ongoing | Ongoing | A fixed window |
| Output | Individual reports | Individual reports | A full report with scope and methodology |
Organizations commonly begin with a vulnerability disclosure policy, also called a responsible or coordinated disclosure policy, often pointed to by a security.txt file (RFC 9116) on their website, and add payments only when their teams can keep up with the reports and the fixes. U.S. federal civilian agencies have had to publish a disclosure policy since CISA's Binding Operational Directive 20-01 in 2020.
Benefits and risks
A bounty brings many testers with different skills, runs continuously and pays only for results. The costs are a high volume of low-quality and duplicate reports, triage effort, disputes over severity and scope, and researchers occasionally straying outside the rules. It does not replace internal testing, or a contracted penetration test where a standard requires one. A bounty must also never be used to disguise a payoff: Uber's handling of a 2016 breach, in which the attackers were paid through its bug bounty program, ended with its former chief security officer convicted in 2022 of obstructing an FTC proceeding and of misprision of a felony.
Bug bounty program on the CompTIA Security+ exam
Bug bounties fall under SY0-801 objective 4.3, where external reporting gives an organization another way to find the vulnerabilities its own scans and tests miss. Wording such as reward outside researchers per confirmed vulnerability points to a bug bounty program. Give outsiders a safe, unpaid way to report flaws points to a responsible disclosure policy, and engage a firm for a two-week assessment points to a penetration test. Researchers who follow a program's rules are also a standard example of ethically motivated hackers, which separates them from attackers who test without permission.