Overview
Bug bounty programs invite security researchers to find and report vulnerabilities in an organization's systems — legally and for reward. Understanding what a program is frames everything in this path. This lesson introduces bug bounty programs.
Learning objectives
- Define a bug bounty program.
- Explain how programs authorize and reward testing.
- Distinguish bug bounty from unauthorized hacking.
Core concept
A bug bounty program is a formal arrangement in which an organization authorizes researchers to test specified systems for vulnerabilities and rewards valid, responsibly-disclosed findings (often with money or recognition). Programs are run directly by organizations or via platforms that host many programs. The program's policy defines what is authorized: the scope, rules, severity/reward structure, and disclosure terms. The program's authorization is what makes the testing legal — bug bounty is authorized security research, not unauthorized hacking.
How it works
An organization publishes a program policy inviting researchers to test in-scope assets under defined rules. Researchers who find valid vulnerabilities report them through the program (not publicly), and the organization triages, fixes, and rewards them. The program's policy is the authorization boundary — testing within it is sanctioned, testing outside it is not. This model benefits both sides: organizations get many researchers finding real issues; researchers get legal opportunity and reward. Everything hinges on respecting the program's scope and rules.
Practical example
A company launches a bug bounty program with a policy stating which of its applications are in-scope, what testing is allowed, how severity maps to rewards, and how to report. A researcher reads the policy, tests only the in-scope applications within the rules, finds a valid vulnerability, and submits a report through the program. The company validates and fixes it and pays a reward. The researcher acted legally because the program authorized testing of those assets — the defining feature of bug bounty.
Cybersecurity relevance
Bug bounty programs are a major part of modern security, harnessing a global community of researchers to find vulnerabilities organizations might miss. For researchers, they provide a legal, ethical path to apply offensive skills for reward — but only within each program's authorization. The critical principle, echoing the ethical-hacking path, is that authorization (the program scope/rules) is what makes it legal; testing outside a program's scope is unauthorized and illegal. This module's focus is understanding programs so researchers operate legally and effectively.
Common mistakes
- Testing systems not covered by a program (no authorization = illegal).
- Ignoring the program policy, which defines what is actually authorized.
- Assuming skills or a platform account grant permission beyond the program's scope.
Key takeaways
- A bug bounty program formally authorizes researchers to test specified systems and rewards valid, responsibly-disclosed findings, often via a platform.
- The program policy (scope, rules, severity/reward, disclosure) is the authorization boundary — within it is legal, outside it is not.
- Bug bounty is authorized security research (not unauthorized hacking); respecting each program's scope and rules is the defining principle.
Check your understanding
- What makes testing under a bug bounty program legal, unlike unauthorized hacking?
- What does a program's policy define, and why must a researcher read it before testing?