---
title: "Bug bounty"
description: "A bug bounty program pays security researchers for responsibly reported vulnerabilities. See how scopes, rewards and triage work in practice."
url: "https://nodea.io/en/glossary/bug-bounty"
lang: "en"
updated: "2026-07-13"
---

# Bug bounty

> A bug bounty is a program in which an organization pays independent security researchers for responsibly disclosed vulnerabilities found in its systems.

A **bug bounty** is a standing program in which an organization pays independent security researchers — ethical hackers — for responsibly disclosed vulnerabilities found in its applications, infrastructure or devices. The economics are straightforward: paying a friendly researcher for a flaw is vastly cheaper than the breach that follows a criminal finding it first. Netscape ran the first program in the 1990s; today bounties are operated by tech giants and mid-size companies alike, either in-house or through platforms such as HackerOne, Bugcrowd and Intigriti.

## How a bug bounty program works

Everything hangs on the published policy, which defines:

- **scope** — which domains, apps and systems may be tested, and what is explicitly off-limits,
- **rules of engagement** — no data exfiltration, no social engineering, no denial-of-service, confidentiality until the fix ships,
- **reward tiers** — payouts scaled by severity (commonly CVSS-based), from token sums for minor issues to six-figure rewards for critical remote-code-execution bugs at the largest programs,
- **reporting requirements** — reproduction steps and a working proof of concept.

Submissions go through triage: validation and deduplication (only the first reporter of a given [bug](https://nodea.io/en/glossary/bug) is paid), then remediation, payout and often a public hall-of-fame credit. Programs can be public or invitation-only, and many organizations start with a plain vulnerability disclosure policy — a safe reporting channel advertised via *security.txt*, without guaranteed rewards.

## Practical use

A bounty complements rather than replaces [penetration testing](https://nodea.io/en/glossary/penetration-testing): a pentest buys systematic coverage on a schedule, while a bounty buys continuous scrutiny from thousands of specialists with different toolkits. The findings skew toward the [OWASP](https://nodea.io/en/glossary/owasp) Top 10 — cross-site scripting, broken access control (IDOR), injection flaws and SSRF dominate platform statistics.

For a company, the prerequisite is maturity: a responsive triage process, a realistic reward budget and the engineering capacity to fix what gets reported — an ignored inbox burns researcher goodwill fast. For researchers, bounty hunting has become a genuine career path, with the top hunters earning a full-time living from rewards alone.

### How is a bug bounty different from a penetration test?

A pentest is a scoped, time-boxed engagement by a chosen team for a fixed fee, ending in a report. A bug bounty runs continuously, taps an open crowd of researchers with diverse specialties, and pays only for valid, unique findings. Mature organizations run both.

### Is hunting bug bounties legal?

Yes, as long as you stay within the program's published policy: test only in-scope systems, avoid data exfiltration and service disruption, and report privately. Probing systems without authorization remains illegal even with good intentions — the safe-harbor terms exist precisely to draw that line.

## Related

- [Bug](https://nodea.io/en/glossary/bug)
- [Exploit](https://nodea.io/en/glossary/exploit)
- [Penetration testing](https://nodea.io/en/glossary/penetration-testing)
- [OWASP](https://nodea.io/en/glossary/owasp)
- [XSS](https://nodea.io/en/glossary/xss)

---

Languages: [pl](https://nodea.pl/pl/slownik-pojec/bug-bounty.md)  
Site index: [llms.txt](https://nodea.io/en/llms.txt)