The bug bounty that's worth running

Most bug bounty programs turn into a tax. The security team spends 80% of their time triaging duplicates and false positives. The payouts go to people who report cosmetic issues. The serious vulnerabilities still come from internal review.

What separates a good program

• Tight scope. The fewer things in scope, the higher the signal.
• Clear severity guidelines. Researchers know what's worth their time.
• Fast triage. Slow responses kill researcher interest.
• Rewards proportional to severity. Not flat, not symbolic.

When to start one

Bug bounties work when you've already done the internal security work — when you're confident the easy stuff is closed, and you're paying for outside eyes on the hard stuff. Starting before that is paying strangers to find your own bugs.

A bug bounty isn't a security strategy. It's a finishing move.