The community
Inside people ask, share what they found and solve together what would block anyone on their own. It's free to join: no account, no plan, no email required.
Free and open. You don't need a BBLABS account to join.
What bug bounty really pays: average rewards by vulnerability type and severity, what top hunters earn, the reality for beginners and why most people don't make a living from it.
Gorka El Bochi
Founder of BBLABS
Stop reading about bugs and start hunting them
No card · free Academy · cancel anytime
Quick answer: In bug bounty there's no salary: you get paid per valid flaw. Rewards range from €0 (VDP programs with no payout) to five or six figures for a critical at a large company. An average high-severity reward is around $1,000–5,000; a critical, several thousand and up to tens of thousands. But the reality is harsh: most beginners take months to earn their first bug and very few live off this alone.
In bug bounty there's no salary. You don't get paid by the hour or for being online: you get paid only if you find a valid, non-duplicate flaw and report it well. That means two hunters with the same hours can earn €0 and €20,000 in the same month.
That's why the right question isn't "how much do you earn", but "how much does each flaw type pay and how many can I find". Let's get to the numbers.
Rewards are assigned by severity (usually aligned with CVSS or Bugcrowd's VRT). These are rough ranges you'll see repeated in the public tables of the most active programs (HackerOne, Bugcrowd, Intigriti, 2023–2025). They vary enormously by company:
| Severity | Typical examples | Rough range |
|---|---|---|
| Critical | RCE, authentication bypass, SQLi with data extraction | $2,000 – $20,000+ (tens of thousands in big tech) |
| High | SSRF, stored XSS, IDOR with personal data | $1,000 – $5,000 |
| Medium | CSRF, reflected XSS, chained open redirect | $250 – $1,000 |
| Low | Minor info disclosure, misconfigurations | $50 – $250 |
| Informational / VDP | Missing headers, best practices | $0 (reputation only) |
Two important nuances:
Broadly speaking, what pays most is what comes closest to money, personal data or code execution:
| Flaw family | Why it pays (or not) | Typical reward |
|---|---|---|
| RCE / Command Injection | Total control of the server. The holy grail. | Very high |
| Auth bypass / Account Takeover | Logging in as another user or as admin. | High–very high |
| SSRF | Pivots to the internal network and cloud metadata. | Medium–high |
| IDOR / Broken Access Control | Access to other people's data. Very common. | Medium–high |
| SQL Injection | Direct data from the database. | High |
| Stored XSS | Session theft, actions on behalf of the victim. | Medium |
| Reflected XSS / CSRF | Requires interaction; lower impact. | Low–medium |
| Open redirect, info disclosure | Limited impact unless chained. | Low / VDP |
You have the technical explanation of each one in the vulnerability dictionary. If you want to maximize income, specialize in the families at the top (access control, business logic, SSRF), not the ones at the bottom.
47 checks ordered by cost: first what can get you in trouble, then the cheap stuff, and finally the expensive stuff — which is where the big bounties are. I'll send it to your inbox right now.
Unsubscribe in one click, from any email.
This is where the headline figures appear. According to the platforms' annual reports (HackerOne, Bugcrowd, 2019–2024):
But careful: those figures are cumulative (over years) and belong to the top 1%. They're the equivalent of looking at the income of the biggest YouTubers to decide whether "you can make money" uploading videos.
This is the section almost no one tells you:
This isn't to discourage you: it's so you go in with the right expectations. Whoever starts thinking "I'm going to quit my job in three months" quits after six weeks, frustrated. Whoever starts thinking "I'm going to learn to find a real flaw" ends up getting paid.
The difference between earning €0 and earning for real is almost never "knowing more exploits". It's usually this:
If you're coming from scratch, the sensible path is ordered theory in Learn bug bounty and then labs in difficulty order. Money is the consequence, not the goal of the first month.
Can you make a living from bug bounty?
Yes, but it's a minority. A small percentage of hunters turn it into their main income; many use it as a supplement to a salary. Treat it first as profitable learning, not as an immediate replacement for your job.
How long does it take to earn your first bug?
For someone starting from scratch, the realistic answer is several months of consistent practice. Someone who already has a development or pentest background can shorten it considerably.
How much does an XSS pay?
It depends on the type and context. A reflected XSS is usually low-to-medium severity (hundreds of euros); a stored XSS in a sensitive panel can be high. Context matters more than the label.
Do they pay in euros or dollars?
US platforms pay in dollars; European ones (Intigriti, YesWeHack) usually operate in euros. Remember to declare your income: bug bounty is income and it's taxable.
Is it better to have quantity of reports or quality?
Quality. A well-reported critical is worth more than twenty informationals. Plus, the reputation you earn with good reports opens up better-paid private programs.
In bug bounty you can earn anywhere from €0 to life-changing figures, but the real median for someone starting out is far more modest than the headlines suggest. Rewards favor impact (access control, logic, RCE, SSRF) and good reports, not hours online. Go in with the right expectations, specialize in what pays and train with real flaws: money is the consequence of learning to recognize the pattern, and that can be trained.
hunters training
labs from real hacks
completions
paid out for these bugs
Create your free account and practice on labs based on real hacks that paid out thousands of euros. The Academy is free forever.
No card · free Academy · cancel anytime
Learn to identify and exploit IDOR (Insecure Direct Object Reference) vulnerabilities in web applications. From the basics to writing effective reports.
A complete guide to getting started on HackerOne: from creating your account to submitting your first vulnerability report. Tips for beginners.
What bug bounty is, how a program works step by step, which platforms it runs on (HackerOne, Bugcrowd, Intigriti, YesWeHack), how much you earn, whether it's legal and where to start from scratch.