What is bug bounty?
Bug bounty programs are initiatives run by organizations that invite ethical hackers to find and report security vulnerabilities. In return, researchers receive monetary rewards based on the severity of their findings.
Unlike traditional penetration tests (limited time, limited scope) or automated scanners (high noise, low signal), bug bounty hunters provide continuous, real-world testing that uncovers vulnerabilities automated tools often miss.
Common pitfalls to avoid
Read the scope
Before testing any target, always read the program's scope and policy. Programs spend lots of time into crafting a policy that they want you to carefully read as that's the place where they announce known issues and accepted risks. Reading the scope will help you avoid submitting invalid submissions.
Pick the target that matches your skillset
Pick a program with an interesting scope that matches your skillset. If you're more proficient in mobile testing, it makes the most sense you select a program that has at least one mobile application in scope. The same applies if you're more skilled in testing for instance, targets built with a specific technology.
Avoid full reliance on automated tooling
Understand the full process first before picking up any tools. 'Spraying and praying' with automated tooling almost never results in valid submissions that pay out big rewards.
Avoid sending in poor reports
At the end of the day, you'll be submitting your report for review. Learn how to write compelling vulnerability reports that get triaged faster. Poorly written reports almost introduce confusion to the triage team and respective security team, which you want to ultimatily avoid.