What Is a Bug Bounty?
A bug bounty is a program that pays security researchers to find and responsibly report vulnerabilities. It turns the world’s independent testers into an extension of a company’s security team — legally, within defined rules — and rewards them for making systems safer instead of exploiting them. For newcomers, it is one of the clearest legal on-ramps into hands-on security.
How does a bug bounty program work?#
Every program is defined by three things:
- Scope — exactly which domains, apps, or systems you may test. Everything else is off-limits.
- Rules of engagement — what techniques are allowed (and forbidden, e.g. no denial-of-service).
- Rewards — payment tiers, usually scaled by severity via CVSS and real-world impact.
You test within scope, submit a clear vulnerability report, and the organization triages, fixes, and pays. Platforms like HackerOne and Bugcrowd standardize the process.
Why do bug bounties exist?#
Because more eyes find more bugs, and paying for them beats the alternative:
| For the organization | For the researcher |
|---|---|
| Continuous testing by many skill sets | Legal, paid hacking practice |
| Pay only for real, valid findings | A public track record |
| A safe channel instead of leaks | A path into the profession |
Bug bounties operationalize responsible disclosure. For the practical how-to, see getting started with bug bounties. More at the Security Fundamentals hub.
Frequently asked questions#
How does a bug bounty program work?
An organization publishes a scope (which systems are fair game), rules of engagement, and reward tiers. Researchers test within that scope, report vulnerabilities they find, and receive payment based on severity and impact. Platforms like HackerOne and Bugcrowd mediate the reports, triage, and payouts.
Is bug bounty hunting legal?
Yes — when you stay strictly inside the published scope and rules. The program is your written authorization to test those specific systems. Going outside scope, testing systems not listed, or breaking the rules removes that protection and can cross into illegal activity. The scope is the law of the engagement.