Englishবাংলা
SubscribeWrite
Latest
Binary search: patterns, templates and common pitfallsDocker's $250 Cloud Sandboxes credit: what it covers and what it does notTwo pointers and sliding window: patterns with examplesArrays and hash maps: the interview patterns you must knowBig-O notation explained: time and space complexity for interviewsSoftware testing basics: the test pyramid and what to testClean code and code review habits that make you a better developerREST API design best practices: URLs, status codes and errors

Bug bounty platforms: how to choose where to start

Where you hunt matters as much as how. Learn how platforms differ, what a VDP is, and how to pick a first program that will not waste your time.

••2 min read
Several program logos on a map

A bug bounty platform connects companies that want their systems tested with researchers who report issues. Reports follow a common process: submit, triage, fix, reward, disclosure.

Well-known platforms

Several platforms host programs, for example HackerOne, Bugcrowd, Intigriti and YesWeHack. Many companies also run their own program on their website (often listed on a security.txt file or a "responsible disclosure" page).

They are similar in how they work. Differences that matter to you:

  • Number and type of programs available to new researchers.
  • Reputation or points systems that unlock private invites.
  • Triage speed and quality and how disputes are handled.
  • Payout methods and regional availability, so check that you can actually receive payments in your country.
  • Community and learning resources.

You do not have to pick only one. Many hunters register on two or three. Read each platform's current terms and rules yourself, since they change.

Types of programs

  • Bug bounty program: pays money for valid reports.
  • VDP (vulnerability disclosure program): accepts reports and may give thanks or points, but usually no money. A VDP is still a good place to practise reporting, build a track record and see how triage works.
  • Public vs private: public programs are open to everyone and crowded. Private programs invite researchers after they build reputation, often with fewer competitors.

How to pick a first program

Look for:

  1. Clear scope with a long list of assets, and a policy written in plain language.
  2. Responsive triage. The program page shows response times and how many reports were resolved.
  3. A large or varied web application, where there are many features and new code to test.
  4. Fair rules and a safe harbor statement that protects good-faith researchers.
  5. Recent activity: new assets, recent changes and recent payouts.
  6. A manageable size for you: start with one app and learn it deeply.

Be careful with:

  • Programs with vague or contradictory scope.
  • Very popular programs with huge crowds, where easy bugs are already found.
  • Programs that forbid the kind of testing you want to do.

Before you submit anything

  • Create your own test accounts, as the policy allows.
  • Note which domains and features are in scope and which are out.
  • Confirm what the program says about automated scanning and rate limits.
  • Never test third-party services connected to the target unless they are listed.

Building a track record

Early on, aim for a few good-quality valid reports, not many weak ones. A clean history improves your standing and can lead to private invitations.

Takeaway: choose platforms you can be paid on, start with a program that has clear scope and active triage, use VDPs for practice, and stay within the rules.

Bug Bounty series, Part 1 (getting started): 2 of 4. Previous: Bug bounty for beginners: a realistic roadmap.

Keep reading