A bug bounty is a programme in which an organisation invites independent security researchers to find and report vulnerabilities, and pays or recognises them for valid findings. Programmes run directly or through dedicated platforms.
Why it matters
A crowd of researchers brings varied skills and perspectives beyond what an internal team or a periodic audit covers. Good programmes publish clear rules: which systems are in scope, what testing is allowed, how to report, and how reports are triaged and rewarded. Safe-harbour language states that good-faith research within the rules will not be pursued legally, though the exact legal position varies by country.
Example
A company lists its main website and API as in scope, and excludes denial-of-service testing and social engineering of staff. A researcher reports an access control flaw with clear steps. The team confirms it, fixes it, rates its severity, pays the reward and thanks the researcher publicly if they agree.
Common mistakes
- Launching without the capacity to triage and fix reports quickly.
- Vague scope, which leads to accidental testing of fragile or third-party systems.
- Ignoring or arguing with reporters, which discourages future reports.
- Expecting the programme to replace internal security work.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.