Start here: bug bounty basics

Bounty or disclosure program?

A bounty pays money (sometimes swag or credits) for valid reports. A vulnerability disclosure program (VDP) accepts reports and promises not to take legal action, but doesn't pay. VDPs are a good place to practise and build a track record. Every program page here shows which one it is at the top.

What scope means

Scope is the list of targets you may test: domains, wildcards such as *.example.com, mobile apps, APIs, source code or smart contracts. Anything not listed is out of scope, and "out of scope" lists name targets and bug types the program won't accept. Testing out of scope can be illegal, so check the program's own page before you start. Programs that add new scope often have bugs nobody has found yet: the new scope filter shows them.

How severity sets the pay

Most programs pay by severity: Critical, High, Medium, Low, sometimes Informational (usually unpaid). Severity is often scored with CVSS, and Web3 programs often use Immunefi's classification, which looks at funds at risk. A program page shows the amount for each level, in the program's own currency.

What safe harbor is

Safe harbor is the program's promise not to pursue legal action when you test in good faith and follow its rules. "Full" safe harbor usually also covers anti-hacking and anti-circumvention laws. Programs without it are riskier. The safe harbor filter keeps only programs that state it.

Picking a first program

Wide scope beats high rewards. A program with many targets and wildcards gives you more to explore than one with a big top reward and a single domain.
New programs and new scope have had fewer eyes on them. Sort the list by newest, or watch the Changes feed.
Open source lets you read the code before you test. Open-source programs.
No KYC means you can be paid without sending identity documents. Bounties without KYC.
Response times matter: a program that answers in days keeps you learning; one that takes months does not.

Programs that pay for low bugs

Many programs pay nothing for Low severity, which is where most first findings land. Some do. Programs that list a Low reward show it in their reward table. On Sorona, open-source projects that have no bounty of their own are paid by Sorona itself, and a valid Low finding there earns a month of Claude Max ($100); Medium starts at $300 and Critical at $1,500. Terms are on Sorona's platform page.

Writing a report that gets paid

Lead with the impact in one sentence: what an attacker can do, to whom.
Give exact steps a stranger can follow, with requests, accounts and versions.
Include a proof of concept when the program asks for one. Many Web3 programs require it.
Don't pad with automated scanner output or theoretical bugs; most programs exclude them.
One bug per report, unless the program says otherwise.

Glossary

CVSS: A 0–10 score for how bad a vulnerability is, used by many programs to set severity.
Duplicate: A report of a bug someone already reported. Usually unpaid.
KYC: "Know your customer": identity checks before payout.
PoC: Proof of concept: code or steps showing the bug really works.
Primacy of impact: A Web3 rule: a bug that hurts an in-scope asset counts even if it lives in an unlisted contract.
security.txt: A file at /.well-known/security.txt where a site says how to report security bugs (RFC 9116).
Triage: The first review of a report, to confirm it is valid and set its severity.
VDP: Vulnerability disclosure program: reports are welcome, but unpaid.
Wildcard: A scope entry like *.example.com that covers every subdomain.