Bug Bounty

In a bug bounty program, an organization publishes rules inviting security researchers, either anyone or an invited group, to look for vulnerabilities in its websites, apps or products, and pays a reward, the bounty, for each valid report it hasn't received before. Rewards grow with severity, from small amounts for minor issues to very large sums for critical flaws in major platforms. Netscape ran one of the first programs in 1995, and today companies such as Google, Microsoft and Apple, as well as many governments, run them, often through platforms such as HackerOne, Bugcrowd and Intigriti.

The program's policy defines the scope, meaning which domains and apps may be tested, and forbids harmful techniques such as denial-of-service attacks, social engineering or reading other users' data beyond what proves the bug. It also explains how to report and includes a safe harbor statement promising not to take legal action against researchers who follow the rules. The security team then triages each report: it reproduces the issue, rates its severity, often with the CVSS scoring system, fixes it and pays the reward, usually only to the first person who reported that bug.

It is like a bank offering a reward to anyone who finds a weak spot in its vault and tells the bank instead of robbing it. Without payments, the same idea is a vulnerability disclosure policy (VDP): a public promise about how to report safely, often advertised in a security.txt file as defined by RFC 9116. Many organizations start with a VDP and add bounties once they can handle the volume of reports.

A bug bounty is often confused with penetration testing. A penetration test is a contract with a chosen team for a fixed scope and time, paid for the work, with a full report even if little is found; a bug bounty is open-ended and continuous, draws on many testers with different skills and pays only for valid findings. Bounties can also bring floods of duplicate or low-quality reports and don't guarantee that anything was tested thoroughly, so organizations use both, alongside secure development.