Scope
InformationalScope
Definition
The Scope in bug bounty defines which assets, domains, features and vulnerability types are valid to report. Every bug bounty program has a specific scope that includes the 'in scope' assets (where you can hunt) and the 'out of scope' ones (where you can't). Understanding and respecting the scope is essential to avoid invalid reports and possible legal consequences.
Impact
Defines which assets are valid for researchDetermines which vulnerability types are acceptedLegal protection for the researcher within the defined scopePrioritization of effort on higher-reward assetsOut-of-scope reports are rejected and hurt your reputation
Examples
Example of a typical scope in a bug bounty program
A typical program defines: In Scope: *.example.com (wildcard), app.example.com, api.example.com. Out of Scope: blog.example.com (WordPress managed by third parties), staging.example.com. Accepted vulnerabilities: XSS, SSRF, SQLi, IDOR, RCE. Excluded: Self-XSS, logout CSRF, rate limiting, missing captcha, open ports without demonstrated impact.