Bug bounty

What it means

A bug bounty is a programme in which a company rewards independent security researchers for finding and reporting vulnerabilities in its websites, apps or systems. The rules set out in advance what may be tested, how to report and what the rewards are.

It complements penetration testing: a test is done by one supplier over a limited time, while a bug bounty opens the system to many hackers continuously. Payment is made only for real, verified findings.

Programmes run through specialist platforms or directly by the company. A simpler form is a responsible disclosure policy, which offers no rewards but gives researchers a legal channel and a promise not to sue them.

How it works in practice

For small firms a full bug bounty programme is usually too expensive and demanding to handle. A page with a vulnerability reporting contact and a security.txt file on the website, so researchers know whom to write to, are enough.

Every report must be verified, rated for severity, fixed and the researcher informed. Serious bugs are handled through incident response, and in widely used software they may receive a CVE identifier.

Rewards paid to researchers are tax-deductible. With foreign researchers, check whether it is a service received from abroad and whether withholding tax applies.

What to watch out for

Without clear rules a researcher may disrupt operations or access personal data while testing. The programme must list forbidden techniques such as DDoS and prohibit access to customer data beyond what is necessary.

An ignored report is a risk: the researcher may eventually publish the bug and attackers exploit it as a zero-day. Even companies without a programme should have a procedure for responding to reports.