Cybersecurity glossary
What is a Bug Bounty?
Learn what a bug bounty program is, how rewards and scope work, how bounties differ from pentests, and how organizations run safe, productive researcher programs.
Definition
A bug bounty is a program in which an organization invites independent security researchers to find and report vulnerabilities in defined assets—usually in exchange for recognition or monetary rewards scaled to impact—under published rules of engagement.
Why pay strangers to hack you
Attackers already look. A bug bounty redirects some of that attention into a channel with rules, safe harbor, and incentives to report instead of sell or abuse. Done well, it extends testing beyond annual pentest snapshots.
Done poorly, it becomes a ticket firehose with unpaid researchers and unpatched crowns.
How a bounty program operates
Publish scope and policy
List in-scope assets, banned tests, reward ranges, and legal safe harbor.
Researchers hunt and report
Findings arrive with steps, impact, and preferably a safe PoC.
Triage validates and severities
Security ops reproduce, dedupe, and rate impact against policy.
Engineering remediates
Owners fix root causes under SLAs matched to severity.
Reward and retest
Pay qualifying reports; invite researchers to verify the fix when appropriate.
Program shapes you will see
Public bounty
Anyone can participate; highest volume and highest triage load.
Private / invite-only
Vetted researchers; useful while building process maturity.
VDP without pay
Structured reporting path—often the first step before rewards.
Platform-managed
Third-party platforms handle researcher community and workflows.
Bounty vs hired testing
| Dimension | Bug bounty | Pentest |
|---|---|---|
| Effort guarantee | Variable researcher interest | Contracted hours/objectives |
| Cadence | Continuous | Point-in-time |
| Coverage style | Opportunistic depth on attractive targets | Scoped methodical review |
| Cost model | Pay for accepted valid findings | Pay for engagement regardless of count |
- Staff triage before launching rewards—response time is reputation.
- Write unambiguous scope with examples of out-of-scope noise.
- Align payout tables to real business impact, not vanity CVSS alone.
- Give engineering owners SLAs so accepted bugs do not linger publicly known.
- Offer safe harbor for good-faith research within policy.
- Track duplicate rates and root causes to improve product hardening.
- Start private if public volume would overwhelm a small security team.
- Never encourage destructive testing; ban DoS and data exfiltration explicitly.
The practical takeaway
A bug bounty turns external research into a paid, policy-bound pipeline. Pair it with triage capacity and remediation muscle—or delay launch until both exist.
Rewards without fixes teach researchers that your brand pays late and attackers that your bugs stay open.
Related security terms
Responsible Disclosure
Ethical reporting practices that bounty programs formalize with rewards.
Penetration Testing
Time-boxed hired testing that complements continuous bounty coverage.
Proof of Concept (PoC)
Evidence researchers attach to validate bounty submissions.
False Positive
Noise that triage teams must filter in high-volume programs.
Remediation
Fix work that must keep pace with incoming bounty findings.
Frequently asked questions
What is a bug bounty in simple terms?
It is a public or invite-only deal: researchers look for security bugs in your listed systems and get paid when valid, in-scope issues are accepted.
How is a bounty different from a VDP?
A vulnerability disclosure policy (VDP) invites reports, often without payment. A bug bounty adds rewards for qualifying findings.
Do bounties replace pentests?
No. Bounties provide continuous, opportunistic coverage. Pentests provide scheduled depth, guaranteed effort, and specific objectives.
What belongs in program scope?
Explicit asset lists, excluded targets, allowed techniques, out-of-scope categories (like DoS), and safe harbor language.
Why do duplicates happen?
Many researchers find the same bug. Programs typically pay the first valid report and mark later ones as duplicates.
What slows bounty success?
Vague scope, slow triage, unpaid criticals, and engineering backlogs that leave accepted bugs unfixed.
Should startups start with a bounty?
Often start with a VDP and private/invite bounty after basic hygiene and triage capacity exist.
References
Explore authoritative guidance and frameworks related to bug bounty.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.