Understanding the program rules
Before you start looking for vulnerabilities in a bug bounty program, it is important to fully understand the rules. These rules may vary by company and specific program, but in general, the following types of rules are stated:
- Systems that can be tested: Bug bounty programs typically specify which systems and applications can and cannot be tested.
- Types of vulnerabilities that can be reported: Companies may set limits on the types of vulnerabilities that can be reported or focused on at any given time.
- The disclosure process: Companies usually have a specific process that researchers must follow to report a vulnerability. It is important to understand and follow this process to avoid any problems or misunderstandings.
- The rewards: Companies also specify the rewards offered for reported vulnerabilities. It is important to note that rewards may vary depending on the severity of the vulnerability and the company in question.
