Verify a Bug Bounty Program Before You Start Hunting

Before you spend hours testing a target, verifying that its bug bounty program is legitimate, clearly scoped, and worth your time can save you from wasted effort and potential legal trouble. This guide walks you through confirming program details, checking scope and rules, and ensuring the program is active and pays as promised.

What You’ll Need

• A web browser and internet connection
• The program’s official URL or name
• Access to a bug bounty platform account (e.g., HackerOne, Bugcrowd, Intigriti) if the program is hosted there
• Basic understanding of web technologies and common vulnerability types

Step-by-Step

1. Locate the official program page. Search for the company’s official bug bounty program page, often linked from their security page or website footer. For platform-hosted programs, navigate directly to the program’s page on the platform. Be cautious of look-alike domains or phishing pages.
2. Check the program’s status. Look for a status indicator such as “Active,” “Paused,” or “Private.” An active program is currently accepting submissions. Paused or private programs may have limited access or temporarily stop accepting reports.
3. Review the scope. The scope defines which domains, applications, and assets are in-bounds for testing. Ensure the asset you plan to test is explicitly listed. Out-of-scope assets are off-limits and testing them can lead to legal action.
4. Read the rules of engagement. Pay attention to allowed testing methods, prohibited actions (e.g., social engineering, denial-of-service attacks), and any specific instructions for handling sensitive data. Violating these rules can get you banned or sued.
5. Verify the reward structure. Check the minimum and maximum bounties, payout amounts for different vulnerability severities, and whether rewards are paid in money, points, or swag. Ensure the program has a clear and reasonable payout process.
6. Look for program history and reputation. On platforms, review the program’s response rate, average time to first response, and resolution time. Read public comments or reviews from other researchers if available. A program with a poor track record may not be worth your time.
7. Check for legal disclaimers and safe harbor. A good program includes a safe harbor policy that protects researchers from legal action when they follow the rules. Confirm that the policy is clear and covers your intended testing.
8. Confirm the program is not a duplicate or fake. Search for the company’s official website and verify that the program page is linked from there. If the program is only on a third-party platform, cross-check with the company’s security contact or official social media.
9. Test the reporting process. Before deep testing, submit a test report (if allowed) or check the submission form to ensure it works. Some programs have a “test” button or allow you to submit a dummy report. This also gives you a feel for the response time.
10. Look for any recent changes. Check the program’s changelog or update history. Programs sometimes change scope, rules, or rewards. Ensure you are working with the latest version.

Common Mistakes

• Testing out-of-scope assets. Even if an asset is owned by the same company, if it’s not listed in scope, it’s off-limits. This is the most common way researchers get into trouble.
• Ignoring the rules of engagement. Some programs prohibit automated scanning, while others allow it. Not reading the rules can lead to your report being rejected.
• Assuming all programs are active. A program may be listed but paused or closed. Always check the status.
• Not checking for safe harbor. Without a safe harbor policy, you could face legal consequences even if you follow the rules.
• Relying on third-party claims. Some websites list bug bounty programs that may not be official. Always verify with the company.

Tips

• Start with well-known platforms like HackerOne or Bugcrowd, as they vet programs and provide a structured environment.
• Look for programs that have been active for a while and have a history of paying bounties.
• Check if the program has a “hall of fame” or public acknowledgments—this indicates they value researchers.
• If you’re new, consider starting with programs that have a low barrier to entry and clear scope.
• Keep a record of the program’s rules, scope, and safe harbor policy for your own reference.

Troubleshooting

If the program page is down or you can’t find it, try these steps:

• Use the Wayback Machine to view an archived version of the page.
• Check the company’s official security page—many companies list their bug bounty program there.
• Contact the company’s security team directly via email or a contact form, asking for the program details.
• If the program is on a platform, contact the platform’s support for assistance.

If you find that the program is not legitimate or is a scam, report it to the platform or the company’s security team. Do not engage with it.

Frequently Asked Questions

What is a bug bounty program?

A bug bounty program is an initiative where companies invite security researchers to find and report vulnerabilities in their systems in exchange for rewards.

How do I know if a program is legitimate?

Check if the program is listed on a reputable bug bounty platform or linked from the company’s official website. Verify the contact information and look for a safe harbor policy.

Can I test any part of the company’s website?

No, you can only test assets explicitly listed in the program’s scope. Testing out-of-scope assets is prohibited and may have legal consequences.

What is safe harbor?

Safe harbor is a policy that protects security researchers from legal action when they report vulnerabilities in good faith and follow the program’s rules.

What should I do if I accidentally test an out-of-scope asset?

Stop testing immediately, do not access or download any data, and report the incident to the program’s security team as soon as possible.

Are bug bounty rewards always monetary?

No, rewards can include money, points, swag, or recognition. The program page will specify the reward structure.

Related

• Robot Submarines and Sonar: Public Evidence
• Complacent Photographer Signs & How to Overcome
• How Astronomers Use Webb & Hubble for Star Formation