Overview
Beyond scope, each bug bounty program has rules governing how you may test and behave. Following them is mandatory and protects both researcher and organization. This lesson covers program rules.
Learning objectives
- Explain the role of program rules.
- Identify common rules and prohibited actions.
- Connect rules to safe, legal participation.
Core concept
Rules in a program policy specify how testing must be conducted: prohibited techniques (commonly denial-of-service, social engineering, physical attacks, automated scanning limits, or testing that could harm data/users), data-handling requirements (don't access/exfiltrate more data than needed to prove an issue), testing constraints (rate limits, use of test accounts), and disclosure requirements (report privately; don't disclose publicly without permission). Rules exist to keep testing safe for the organization and its users and to keep researchers within legal, ethical bounds.
How it works
The researcher reads and follows the rules throughout testing. Prohibited techniques are avoided entirely (e.g. no DoS, no social engineering against staff, no attacks that could damage data or affect real users). Data encountered is handled per the rules — proving an issue with minimal access, never exfiltrating or exposing user data. Findings are reported privately through the program and not disclosed publicly except as the program's disclosure terms allow. Violating rules — even with good intent — can void authorization, cause harm, and lead to bans or legal consequences. Following rules is as binding as respecting scope.
Practical example
A program's rules prohibit denial-of-service and social engineering, require using test accounts rather than real user accounts, limit automated scanning rates, and require private disclosure. A researcher testing the program avoids any DoS or social-engineering attempts, uses provided test accounts, keeps scanning within the allowed rate, and reports findings only through the program — not publicly. By following every rule, they test safely and legally, and their findings are eligible for reward.
Cybersecurity relevance
Program rules keep bug bounty testing safe and legal: prohibited-technique rules prevent harm (DoS outages, social-engineering harm to people), data-handling rules protect user privacy, and disclosure rules protect the organization (and users) by keeping vulnerabilities private until fixed. Violating rules can cause real harm, void the researcher's authorization, and result in bans or legal action, even within scope. Following rules — echoing the rules-of-engagement discipline from the ethical-hacking path — is essential to responsible, sustainable participation and preserves trust in the bug bounty ecosystem.
Common mistakes
- Using prohibited techniques (DoS, social engineering) despite the rules.
- Accessing/exfiltrating more data than needed or testing on real user accounts when test accounts are required.
- Disclosing findings publicly without following the program's disclosure terms.
Key takeaways
- Program rules govern how you test: prohibited techniques (DoS, social engineering, etc.), data-handling, testing constraints, and disclosure requirements.
- They keep testing safe for the organization and users and keep researchers within legal/ethical bounds; violating them (even with good intent) voids authorization and can cause harm.
- Following rules is as binding as respecting scope — echoing rules of engagement — and is essential to responsible, sustainable participation.
Check your understanding
- Name three techniques commonly prohibited by bug bounty program rules and why.
- Why must findings be disclosed privately through the program rather than publicly?