What is bug bounty? A complete guide to understanding how it works

Quick answer

Bug bounty is an arrangement where a company pays external researchers to find and report vulnerabilities in its systems. It runs on platforms like HackerOne, Bugcrowd, Intigriti or YesWeHack that act as intermediaries: they define the scope, validate the reports and process the payments. Typical bounties: €100-€500 (low), €500-€2,000 (medium), €2,000-€10,000 (high/critical).

How a program works

A bug bounty program has four key elements:

1. Scope. The exact list of which domains/apps/services can be tested. Anything outside that scope (out-of-scope) is forbidden and isn't paid even if you find it.
2. Policy. The rules — which types of testing are allowed, which methodologies are blocked (e.g. DoS, social engineering), whether there's legal safe harbor.
3. Bounty table. Payout by severity, usually CVSS or custom categories (low, medium, high, critical).
4. Process. How to report, what information is needed, average response time.

Programs can be:

• Public: open to anyone with an account on the platform. More competition → more duplicates → lower average bounties.
• Private: invite only. Less competition, better bounty/time ratio.
• VDP (Vulnerability Disclosure Program): they don't pay, only accept reports. Useful for initial reputation but not monetizable.

Types of vulnerabilities that get paid

The most reported classes (and their typical bounties):

High-impact vulnerabilities (RCE, ATO, massive PII leak) scale to €5,000-€50,000+ in large programs.

What usually isn't paid:

• Self-XSS (only affects the attacker).
• Trivial username enumeration with no chain.
• Missing security headers with no demonstrated impact.
• Open redirects with no OAuth or phishing context.
• Automated scanner reports with no manual verification.

The platforms

Four big operators:

• HackerOne — the largest, the widest variety of programs, a mature community. It supports many SaaS companies and giants (Google, Shopify, Spotify, Uber, etc.).
• Bugcrowd — second in size, a slightly better bounty/competition ratio in private programs.
• Intigriti — a strong European community, support for programs in local languages, competitive bounties.
• YesWeHack — French, strong in EU programs. Good for diversifying.

Each platform has its technical profile, its reputation system and its triage pipeline. It's common to have an account on all four and report wherever the program is.

A hunter's typical flow

1. Read the program's scope + policy
        ↓
2. Recon (subdomains, endpoints, technologies)
        ↓
3. Map features + parameters
        ↓
4. Focused hunt (target vuln class)
        ↓
5. Confirmation + minimal reproducible PoC
        ↓
6. Impact escalation if applicable
        ↓
7. Report (title, steps, impact, fix)
        ↓
8. Triage + back-and-forth with the program team
        ↓
9. Bounty + disclosure (if the company allows it)

80% of the time is before step 4: reading the policy, mapping and understanding the app. The "hunting" itself is faster when you have the target well modeled.

Can you make a living from this?

Possible but not for everyone. Roughly:

• Occasional hunter: €0-€500/month. Reports when they find something, no systematic methodology.
• Dedicated part-time hunter: €500-€3,000/month. 10-15h/week, a main program + secondary ones.
• Full-time hunter: €3,000-€15,000+/month. Specialized in one or two vuln classes, deep knowledge of specific targets.

Big bounties (€5,000+) don't come fast. They usually come from:

• Complex chains that require understanding the target well.
• Vulnerabilities in critical flows (payments, auth, RBAC).
• Targets few people audit in depth (legacy apps, third-party integrations, leaked internal APIs).

Typical mistakes when starting

• Jumping into a target without reading the policy → out-of-scope findings, wasted time.
• Reporting low-impact findings in bulk → bad reputation, high N/A ratio.
• Automating nothing → every audit starts from scratch.
• Only hunting reflected XSS → everyone looks for it, lots of duplicates, low bounty.
• Not reading public reports of the same program → repeating work that's already documented.

Where to start

1. An account on HackerOne, Bugcrowd and Intigriti.
2. Read 20-30 public reports in the category that interests you most.
3. Practice in labs (PortSwigger Web Academy, BBLabs, HackTheBox) to automate the methodology.
4. Start with a public program with broad scope and small bounties — go for your first valid one even if it's €50, not a €5,000.
5. Take notes. Every finding (valid or N/A) teaches you something about your methodology.

Related labs

Practice end-to-end hunting methodology with labs based on real reports.