Bug Bounty
Noun · Security & Infosec · Origin: 1995
Definitions
Bug Bounty is a program offered by organizations that rewards independent security researchers for responsibly discovering and reporting software vulnerabilities. Instead of relying solely on internal security teams, companies crowdsource vulnerability discovery by incentivizing the global hacker community with monetary rewards that scale with the severity of the finding. Payouts can range from a few hundred dollars for minor issues to hundreds of thousands for critical vulnerabilities. Major technology companies including Google, Microsoft, Apple, and Meta operate bug bounty programs, and platforms like HackerOne, Bugcrowd, and Intigriti serve as intermediaries connecting researchers with organizations. Bug bounty programs provide a legal framework for security researchers to report findings (safe harbor), ensuring they are protected from prosecution for their testing activities. The approach has proven highly cost-effective, as finding vulnerabilities before they are exploited in the wild prevents far more expensive incidents. Programs also include clear scope definitions, rules of engagement, and response time commitments.
In plain English: A reward program where companies pay you real money for finding and reporting security holes in their software instead of exploiting them.
Bug bounty programs create a legal framework for security researchers who would otherwise face prosecution under computer fraud laws. Payouts range from $50 for minor issues to $1M+ for critical vulnerabilities in major platforms. Google, Apple, and Microsoft run the largest programs.
Example: 'A researcher earned $100K from our bug bounty program for finding a privilege escalation chain. Cheaper than the breach would have cost us.'
Source: economics / legal framework
Etymology
- 1995
- Netscape launches the first formal bug bounty program
- 2010
- Google launches its Vulnerability Reward Program
- 2012
- HackerOne and Bugcrowd launch as bug bounty platforms