Bug bounty

A bug bounty is a standing offer from a company: if you find a security flaw in our products and tell us privately, following our rules, we will pay you. The amount depends on how serious the problem is, from a small thank-you for a minor issue to large sums for a flaw that could expose user accounts. Big tech companies, banks, governments and many startups run them, often through platforms that handle the reports and payments.

Every program publishes a policy that is the heart of the deal. It lists which sites and apps are in scope, what is off limits (attacking other users, overloading servers, touching real customer data beyond what is needed to prove the point), and how to report. Inside those rules, researchers have permission to test; outside them, the same activity can be illegal. Reports go privately to the company, which confirms the flaw, fixes it, pays, and often lets the researcher publish a write-up afterwards.

That last step is called coordinated disclosure (or responsible disclosure): the problem is made public only once users are protected. Even companies without a paid program usually publish a vulnerability disclosure policy that says how to report a flaw and promises not to take legal action against people acting in good faith.

Bug bounties complement penetration testing rather than replace it. A pentest is a small team for a few weeks; a bounty is many people with different skills looking all year. The catch is that the company must be ready to triage a steady stream of reports, many of them duplicates or not real problems.