Ravindra BagaleCourses & study guides

35. Careers, Certifications and Bug Bounty

35.5 Bug Bounty

Bug bounty programmes let companies invite outside researchers to find security bugs in their systems and reward valid reports, sometimes with money, swag or a hall-of-fame mention.

Platform / route Notes
HackerOne Large global platform with public and private programmes
Bugcrowd Another major platform
Intigriti, YesWeHack European platforms with many programmes
Company-run programmes Some companies run their own pages (look for "security", "responsible disclosure" or /.​well-​known/​security.​txt)

Golden rules:

  1. Read the programme policy fully. Only test assets listed in scope, only with allowed methods. Out-of-scope testing is unauthorised access (IT Act s. 43/66, Chapter 18).
  2. No damage: no denial of service, no mass automated scanning unless allowed, no accessing or downloading other users' data beyond what proves the issue.
  3. Use your own test accounts to show IDOR or access control issues (Chapter 29).
  4. Write a clear report: title, affected URL, severity, steps to reproduce, proof (screenshots, request/response), impact, and suggested fix.
  5. Keep it confidential until the company allows disclosure.

Sample report skeleton:

Title: IDOR allows viewing other users' invoices at /api/invoice?id=
Severity: High (CVSS reasoning included)
Steps: 1) Log in as test user A ... 2) Change id from 1041 to 1042 ... 3) Invoice of test user B is returned
Impact: Any logged-in user can read other customers' invoices (names, addresses, amounts)
Fix: Check invoice ownership on the server for every request

Ravindra Bagale's Tip

In bug bounty you get a lot of "duplicate" and "informative" results – don't be discouraged. At the start, focus not on easy targets but on new scope that few people have tested, do good recon, and write a very clear report. And don't send a single request without reading the policy.

Practice task

Open two public programmes on HackerOne or Bugcrowd and read their policies. For each, list: in-scope assets, out-of-scope assets, forbidden testing methods, and reward rules. Then write a practice report in the skeleton above for an IDOR you find in OWASP Juice Shop (local lab).