The bug bounty that’s worth running

Most bug bounty programs turn into a tax. The security team spends 80% of their time triaging duplicates and false positives. The payouts go to people who report cosmetic issues. The serious vulnerabilities still come from internal review.

What separates a good program

• Tight scope. The fewer things in scope, the higher the signal.
• Clear severity guidelines. Researchers know what’s worth their time.
• Fast triage. Slow responses kill researcher interest.
• Rewards proportional to severity. Not flat, not symbolic.

When to start one

Bug bounties work when you’ve already done the internal security work, when you’re confident the easy stuff is closed, and you’re paying for outside eyes on the hard stuff. Starting before that is paying strangers to find your own bugs.

A bug bounty isn’t a security strategy. It’s a finishing move.