Bug bounty
bug bounty programme · bug bounty program · VDP · vulnerability disclosure policy · coordinated disclosure · bounty hunting
A programme in which an organisation invites security researchers to look for flaws within a defined scope, and rewards them for each valid vulnerability reported.
In practice
The programme publishes its rules: scope, forbidden techniques, reward scale, and a commitment not to pursue researchers who follow them. This contractual framework, often run through a specialist platform, serves as written authorisation for what is in scope; anything else remains an intrusion under Article 323-1 of the French Criminal Code. An organisation can start with a simple vulnerability disclosure policy (VDP), without rewards. In France, reporting a flaw to ANSSI in good faith protects the reporter’s identity (Article L2321-4 of the French Defence Code), but it is not an immunity.
In 2016, the Pentagon launched “Hack the Pentagon”, the first bug bounty run by a US federal agency. Between 18 April and 12 May, 138 valid and unique vulnerabilities were found on five public websites, for a total cost of $150,000, far less than a conventional external audit according to the Department of Defense.
