Bug bounties and responsible disclosure

Bug bounties: permission, published

A bug-bounty programme is a standing invitation from a company: "test these systems, within these rules, and we will reward valid reports". It is a form of written permission, published for everyone. Platforms such as HackerOne and Bugcrowd host many programmes and handle the reports and payments.

The most important part of any programme is its policy and scope page. It lists exactly which systems are in scope, which are out, what techniques are forbidden (often no denial-of-service, no social engineering, no testing other users' accounts), and how to report. Reading and following that page is the whole game — going outside it loses your legal protection and can get you banned or prosecuted.

Responsible disclosure

Responsible disclosure (also called coordinated disclosure) is the ethical way to handle a flaw you find: report it privately to the owner, give them reasonable time to fix it, and only consider public discussion after it is fixed and with their agreement. The opposite — posting a working exploit publicly before a fix — puts real users at risk and may be illegal.

• Report through the official channel (a security.txt file, a bug-bounty platform, or a security contact).
• Give enough detail to reproduce, and the fix if you can suggest one.
• Do not demand payment or threaten to go public — that can be treated as extortion.
• Respect the programme's disclosure timeline and rules.

Why companies run them

Bug bounties let a company get many skilled eyes on their systems and fix flaws before criminals use them, paying only for valid results. For a learner, they are a legal way to practise on real systems, build a reputation, and sometimes earn — as long as you stay strictly within the rules.