A bug bounty program is a public promise: report a vulnerability under these rules and you will be treated fairly and paid. Programs fail when the promise is made before the organisation can keep it. Reports pile up unanswered, duplicates and scanner output bury the valid findings, and researchers move on to programs that respond.
We know programs from the side of the researcher, because we hunt in them ourselves. We prepare yours so that it attracts the people you want: a scope that is worth their time, rules that protect them, rewards that match the impact, and answers that arrive when promised.
01Scope
What we test
Readiness review: can the known issues be fixed before researchers find them
Program policy: rules of testing, exclusions, disclosure terms, safe harbour
Scope definition and staged expansion from private to public
Reward table tied to severity and to the value of the asset
Platform selection, or a self-hosted program where a platform is not wanted
Triage: reproduction, deduplication, severity rating, filtering of automated reports
Communication with researchers, including disputes about severity and reward
Hand-over to engineering: tickets with reproduction steps and fix guidance
Metrics: response time, time to fix, reward spend, quality of submissions
02Approach
How the work is done
01
Readiness
Before anything is announced we test the scope ourselves. Issues that any researcher would find in the first week are fixed first, so that rewards are paid for what is hard to find.
02
Design
Policy, scope and reward table are drafted with your security, legal and finance teams. The safe harbour text follows the wording recognised by the research community.
03
Private launch
The program opens to a limited group of invited researchers. Processes are adjusted under a manageable volume of reports.
04
Operation
We triage every report, reproduce it, rate it and pass confirmed findings to your engineers. Researchers receive an answer within the time stated in the policy.
05
Expansion
Scope and audience grow when the numbers show that the organisation keeps up: response times held, fixes delivered, budget under control.
It depends on where your researchers are, which jurisdictions and payment routes you need, and how much of the operation you want the platform to carry. One of the options is our own platform. We compare it with the others by the same requirements, say so plainly, and take no commission from any other platform.
Do you hunt in the programs you manage?
No. Managing a program and earning rewards from it is a conflict of interest. Our specialists do not submit reports to programs that we operate or have prepared.
Are we ready for a public program?
If you have not had a penetration test, no. Start with a test and a private program. A public launch on an untested scope pays high rewards for findings that a fixed-price assessment would have delivered.
How do you deal with reports generated by AI tools?
Every report is reproduced before it is accepted. A report that cannot be reproduced is closed with an explanation, whoever or whatever wrote it. The policy states this, which discourages the submissions in the first place.