Programs & platforms

Choosing the right program is half the battle: the program type, its maturity, and its rules determine your odds and your reward. This card covers the platforms, program types, and how to choose by your level and style.

Main platforms

HackerOne    the largest; many programs, good reputation/statistics
Bugcrowd     large; VRT (vuln taxonomy) for severity/payout
Intigriti    strong in Europe
YesWeHack    European, many public programs
Synack       a private network of testers (requires selection)
Self-hosted  self-hosted programs (/security.txt, company page)

Program types

VDP   Vulnerability Disclosure Program: NO monetary reward (recognition only)
BBP   Bug Bounty Program: PAYS for bugs by severity
Public   open to all (more competition)
Private  invite-only (less competition; entry by reputation)
Managed pentest  time-limited, paid by time/objectives

How to choose a program

Beginner     VDP or broad-scope, low-competition programs; practice reporting
Broad scope  *.target.com, many assets -> more surface (bb-recon)
Maturity     new/recent program = fewer eyes; old program = more competed but known
Activity     response time and recent payouts (platforms show this)
Technology   choose what you master (APIs, mobile, web) to have an edge

Reputation and progression

- start in public -> good reputation/signal -> invitations to PRIVATE (less competition)
- private programs usually have a better signal-to-noise ratio and team relationship
- consistency > a lucky break: reputation opens doors

Metrics to check before entering

- reward range (bounty table) and recent payouts
- response/triage and resolution time
- signal ratio (do they handle duplicates/informationals sensibly?)
- scope breadth and what's EXCLUDED (see bb-scope)

Blue Team / note (for whoever runs a program)

Define clear scope and rules (Reading the scope & rules), a reward table, and safe harbor (legal protection for the hunter).
Fast triage and respectful communication: a program’s reputation attracts good hunters.
Start with VDP/private to control volume before opening a public BBP.
Integrate findings into the vulnerability management cycle (Vulnerability management) and SDLC (Secure SDLC).

Best practices and common mistakes

Start on programs with broad scope and a good triage reputation; avoid slow-response ones early on.
Build reputation on public programs to get invited to private ones (less competition, higher payout).
VDPs and /security.txt are a good entry point to practice responsible reporting even without pay.

Testing checklist

Choose platform(s) fitting your region/style
Distinguish VDP vs BBP and public vs private
Review the reward table and recent payouts
Check response/triage times
Choose scope/technology where you have an edge
Build reputation in public → private invitations
ALWAYS read the scope and exclusions (Reading the scope & rules)