Getting started in bug bounty
How bug bounty works, the mindset, and how to read a program's scope.
Bug bounty is getting paid to find and report vulnerabilities in real systems — legally, under a program’s rules. It’s the closest thing to professional offense you can do from your laptop.
How it works
- A company publishes a program with a scope, rules, and reward table.
- You test only what’s in scope, following the rules.
- You report a valid bug with clear reproduction steps and impact.
- If it’s accepted, you get paid (a bounty) and/or reputation points.
Platforms like HackerOne, Bugcrowd, Intigriti, and YesWeHack host programs; some companies run their own.
Read the scope first
The scope is the contract. Before sending a single request, know:
- In-scope assets — exact domains, apps, IP ranges, mobile apps.
- Out-of-scope — what’s off-limits (and often what bugs won’t be paid).
- Rules — rate limits, no social engineering, no DoS, test accounts only.
Mindset
Volume of low-quality reports gets you nowhere. Pick a target, learn it deeply, and chase impact. The workflow that follows — recon then hunting specific bug classes — is how consistent hunters operate.