Loading...
Complete setup guides and strategy for every major bug bounty platform — HackerOne, Bugcrowd, Intigriti, Synack, and OpenBugBounty
The world's largest bug bounty platform — public, private, and VDP programs
HackerOne is the most popular bug bounty platform with thousands of programs. It pioneered the hacker-powered security model. The platform features a reputation system based on signal (quality) and impact (severity), which determines your visibility to program managers. HackerOne offers both public programs (anyone can submit) and private invitations. Building a strong reputation is essential for earning invites to high-paying private programs.
Your HackerOne profile is your resume. Program managers review profiles before sending private invitations. A complete profile with a strong hacker reputation, clear methodology write-ups, and resolved reports signals professionalism. Include your skills, tools you're proficient with, and links to your write-ups or research.
## HackerOne Profile Checklist
- [ ] Username: professional, not offensive
- [ ] Bio: 1-2 lines describing your focus area (web, mobile, API, infra)
- [ ] Skills: add relevant tags (XSS, SQLi, SSRF, IDOR, RCE)
- [ ] Website/GitHub: link to your write-ups or research
- [ ] Signal > 0: maintain positive signal by submitting quality reports
- [ ] Impact > 0: focus on confirmed vulnerabilities with clear impact
- [ ] Profile picture: professional or avatar (not blank)Profile checklist — complete these before submitting to any program
## Signal & Impact Explained
**Signal** = Reputation score based on report quality
- Accepted report: +10 to +50 signal
- Duplicate: 0 signal change
- N/A (informative): -5 signal
- N/A (not a vulnerability): -10 signal
- Spam: -50 signal
**Impact** = Severity score based on confirmed findings
- None: 0
- Low: 0.5-3.9
- Medium: 4.0-6.9
- High: 7.0-8.9
- Critical: 9.0-10.0
**Formula**: Signal trends up with quality reports. Impact reflects the total severity of your confirmed findings.HackerOne's reputation system — understand how signal and impact are calculated
## Private Program Invitations
Private programs invite hackers based on:
1. Signal (reputation quality) — higher is better
2. Impact (severity of confirmed findings)
3. Recent activity — active hackers get prioritized
4. Program-specific criteria — some programs want mobile experts
5. Location — some programs restrict by region
**Tips to get invited:**
- Maintain signal > 10 with at least 3-5 accepted reports
- Focus on one program at a time instead of spraying
- Write clear reports with reproduction steps
- Respond to triage questions promptly
- Follow disclosure guidelines exactlyHow private program invitations work and how to get on the invite list
TIPS
HackerOne has three program types: Public (anyone can submit), Private (invite-only), and VDP (Vulnerability Disclosure Program — no monetary rewards). Beginners should target VDPs and low-competition public programs to build signal. Experienced hunters focus on private invitations to high-bounty programs.
## Program Selection Strategy
**Beginner (0-5 accepted reports):**
- Target VDPs and public programs with wide scopes
- Focus on low-hanging fruit: XSS, IDOR, Open Redirect
- Build signal by submitting quality reports, even for low severity
**Intermediate (5-20 accepted reports):**
- Target public programs in your niche (API, mobile, infrastructure)
- Apply for private programs through program invitations
- Start chaining low-severity bugs into medium/high impact
**Advanced (20+ accepted reports):**
- Focus on private programs with bounties > $1000
- Look for logic flaws, race conditions, and complex chains
- Build relationships with specific program managers
**Tips:**
- Sort by "Earliest 1st Report" for fresh programs with less competition
- Filter by bounty range to match your effort level
- Read program scope carefully — out-of-scope = wasted timeProgram selection strategy based on your experience level
curl -s 'https://hackerone.com/programs/search?query=&sort=launched_at:ascending&limit=50' -H 'Accept: application/json' | jq '.results[] | {name: .name, url: .url, bounties: .bounties_enabled}' | head -30Find newly launched programs sorted by oldest first — less competition early on
## HackerOne Bounty Payout Ranges
| Severity | Typical Range | Top Programs |
|------------|-----------------|-----------------|
| Critical | $3,000 - $10,000 | $50,000+ |
| High | $1,000 - $4,000 | $10,000+ |
| Medium | $250 - $1,000 | $2,500+ |
| Low | $100 - $250 | $500+ |
| None | $0 (informative) | N/A |
**Note:** These are approximate. Payouts vary by program. Some programs pay flat rates per severity, others use sliding scales based on CVSS score and business impact.Typical HackerOne bounty ranges by severity — use this to estimate potential earnings
TIPS
HackerOne's triage team reviews every report. Clear, well-structured reports get triaged faster and are less likely to be marked as N/A. Follow the platform's expected format: vulnerability type, impact, steps to reproduce, proof of concept, and remediation suggestion. Include screenshots and HTTP request/response pairs.
## HackerOne Report Template
**Summary:**
[Vulnerability Type] in [Endpoint/Parameter] — [Brief Impact]
**Severity:** [Critical/High/Medium/Low]
**Affected URL:**
https://target.com/[endpoint]
**Description:**
[2-3 sentences explaining what the vulnerability is and why it matters]
**Steps to Reproduce:**
1. [Step 1]
2. [Step 2]
3. [Step 3]
**Proof of Concept:**
```http
[Raw request/response]
```
**Impact:**
[What an attacker can achieve]
**Remediation:**
[Suggested fix]
**Attachment:**
[Screenshot or video demonstrating the issue]HackerOne report template — write reports in this format for faster triage
## Common Reasons Reports Get Marked N/A
1. **Scanner output only** — no manual verification or impact explanation
2. **Missing reproduction steps** — triage can't reproduce the issue
3. **Out of scope** — the endpoint or vulnerability type isn't covered
4. **Self-XSS** — requires the victim to paste attacker-controlled input
5. **Missing browser/PoC** — no screenshot, video, or request/response pair
6. **Informational only** — no security impact demonstrated
7. **Duplicate** — already reported — check before submitting
**Pro tip:** Search the program's disclosure timeline on Hacktivity to check if your bug was already reported before submitting.Reasons HackerOne triage marks reports as N/A — avoid these mistakes
TIPS
RESOURCES IN THIS CHAPTER
HackerOne is the premier bug bounty platform. Build signal, target the right programs for your level, and submit clear reports to succeed. Private program invitations follow naturally from a strong reputation.
Crowdsourced security with a strong focus on priority ratings and managed triage
Bugcrowd uses a priority rating system (P1-P5) instead of traditional CVSS scoring. The platform emphasizes managed triage — their internal team validates your findings before passing them to the customer. Bugcrowd has both public and private programs, and their 'Strengthen Your Resume' feature lets you earn recognized badges. The platform is especially strong for infrastructure and web application testing.
Bugcrowd uses a unique priority rating system (P1-P5). Understanding this system is essential for writing reports that earn maximum bounties. Your researcher rank (based on reputation points and priority submissions) determines visibility to program managers for private invitations.
## Bugcrowd Priority Rating (P1-P5)
| Priority | Label | Definition | Typical Payout |
|----------|-------------|-------------------------------------------------|----------------|
| P1 | Critical | Direct threat to business operations or data | $2,000 - $10,000 |
| P2 | High | Significant impact on security posture | $500 - $3,000 |
| P3 | Medium | Moderate impact, limited exploitation | $200 - $750 |
| P4 | Low | Minor impact, requires unusual conditions | $50 - $200 |
| P5 | Informational | No direct exploit, but useful for defense | $0 (acknowledgment) |
**Key difference from HackerOne:** Bugcrowd uses prioritization (business impact), not just technical severity. A reflected XSS on a critical login page might be P2 here, not P3.Bugcrowd's priority rating system — understand P1-P5 for accurate self-scoring
## Bugcrowd Researcher Ranks
| Rank | Points Required | Benefits |
|---------|-----------------|-----------------------------------------------|
| Level 1 | 0 | Basic access to public programs |
| Level 2 | 250 | Access to some private programs |
| Level 3 | 1,000 | Priority triage, more private invitations |
| Level 4 | 5,000 | Premium support, early access to new programs |
| Level 5 | 25,000 | VIP status, direct program manager access |
**Points are earned by:**
- Accepted submissions: 10-100 points per P1-P3 finding
- Briefings and research contributions
- Helping other researchers (community engagement)
- Participating in Bugcrowd events and CTFsBugcrowd researcher ranks — how points and levels work
TIPS
Bugcrowd programs follow a structured submission workflow. After you submit, Bugcrowd's internal triage team validates the finding, then passes it to the customer. This means you get feedback even if the customer is slow to respond. The platform supports both public and private programs, with a strong emphasis on VDPs as an entry point for new researchers.
## Bugcrowd Submission Workflow
1. **Submit** — Submit your finding through the platform with title, description, priority, and evidence
2. **Triage Review** — Bugcrowd's internal team reviews within 48 hours
3. **Customer Validation** — Customer reviews and either accepts, disputes, or requests more info
4. **Bounty or Kudos** — If accepted, you receive bounty (or Kudos for non-monetary programs)
5. **Disclosure** — After the customer resolves the issue, you can choose to publicly disclose
**Timeline:**
- Triage review: 24-48 hours
- Customer validation: 1-14 days
- Bounty payment: 30-60 days after acceptance
- Public disclosure: at the customer's discretion, typically 90-180 daysBugcrowd submission workflow — from submission to payout
## Bugcrowd Submission Template
**Title:** [Priority] [Vulnerability Type] in [Endpoint]
**Priority:** P1 / P2 / P3 / P4 / P5
**Asset:** [URL or scope item]
**Description:**
[Clear explanation of the vulnerability and its impact on the business]
**Steps to Reproduce:**
1. [Navigate to URL]
2. [Perform action]
3. [Observe result]
**Proof of Concept:**
[Screenshot or video link — Bugcrowd supports video uploads]
**Technical Details:**
[HTTP request/response, payload used, any relevant code]
**Remediation Advice:**
[Your suggested fix]
**Business Impact:**
[Explain what an attacker could realistically achieve]Bugcrowd submission template — formatted for their triage system
curl -s 'https://bugcrowd.com/programs.json' | jq '.programs[] | {name: .name, url: .url, bounty: .bounty, scope: .scope}' | head -40Fetch Bugcrowd programs list — filter by bounty and scope size
TIPS
RESOURCES IN THIS CHAPTER
Bugcrowd's priority rating system and managed triage make it unique. Focus on P1-P3 submissions for maximum value. Build your researcher rank through consistent quality submissions to unlock private programs.
Europe's leading bug bounty platform — lower competition, regional focus
Intigriti is a European bug bounty platform headquartered in Belgium. It has fewer hackers than HackerOne or Bugcrowd, which means less competition for finding bugs. The platform is particularly strong for European targets and has a growing number of global programs. Intigriti offers both public and private programs with a straightforward submission system. Their 'Intigriti Experience' level system rewards consistent participation.
Intigriti's smaller researcher pool means each report you submit has a higher chance of being unique. The platform is ideal for new researchers who want to build experience with less competition. Intigriti also runs regular community challenges (XSS challenges) that help build skills and earn recognition.
## Intigriti vs HackerOne vs Bugcrowd
| Feature | Intigriti | HackerOne | Bugcrowd |
|------------------------|-------------------|----------------|-------------------|
| Total researchers | ~50,000 | ~1,000,000 | ~500,000 |
| Geographic focus | Europe | Global | Global |
| Average response time | 2-3 days | 1-2 days | 1-2 days |
| Payout speed | 15-30 days | 30-60 days | 30-60 days |
| Unique programs | European SMBs | US tech giants | US and AU |
| XSS challenges | Yes (monthly) | No | No |
| Researcher levels | Intigriti XP | Signal/Impact | Rank levels |
**Advantage for beginners:** Less competition means more unique findings. European programs often have less tested attack surfaces.Platform comparison — Intigriti's smaller pool means less competition
## Intigriti XP & Researcher Levels
| Level | XP Required | Benefits |
|-------|-------------|--------------------------------------------------|
| 1 | 0 | Basic access to public programs |
| 2 | 500 | Priority support ticket access |
| 3 | 2,000 | Access to some private programs |
| 4 | 8,000 | Premium support, exclusive program invitations |
| 5 | 25,000 | VIP researcher status, direct access to program managers |
**How to earn XP:**
- Accepted report: 100-500 XP (based on severity)
- Monthly challenge completion: 200 XP
- Helping other researchers: 50-100 XP
- Platform participation: variable XPIntigriti's experience system — XP levels and how to progress
TIPS
Intigriti programs tend to be European companies with smaller security teams. This means your reports need to be extra clear and self-contained, as the internal team may have less bandwidth. Focus on programs aligned with your skills and the timezone of the target.
## Intigriti Submission Template
**Title:** [Vulnerability Type] - [Brief Description]
**Program:** [Program Name]
**Severity:** [Critical/High/Medium/Low]
**Target:**
https://[target-domain.com]
**Vulnerability Description:**
[2-3 sentences]
**Proof of Concept:**
1. [Step-by-step]
2. [Include screenshots with annotations]
3. [Show the impact clearly]
**Request/Response:**
```http
[Raw traffic]
```
**Suggested Fix:**
[Brief remediation advice]
**References:**
[Link to OWASP, CWE, or similar documentation]Intigriti submission template — self-contained reports help smaller security teams
## Finding Intigriti Programs
Browse programs: https://www.intigriti.com/programs
**Filters to use:**
- Sort by 'Newest' to find fresh programs
- Filter by 'Bounties: Yes' for paid programs
- Check 'European targets' if you're in a compatible timezone
- Look for programs with 'View all' scope — wider scope = more attack surface
**Pro tip:** Many Intigriti programs are managed through their 'Extreme' level, which offers premium support and direct communication with the program team.How to find and filter programs on Intigriti platform
TIPS
RESOURCES IN THIS CHAPTER
Intigriti offers lower competition and faster payouts than the major platforms. Ideal for European targets and new researchers looking to build a track record. The monthly XSS challenges are a bonus learning opportunity.
Invite-only elite platform — higher barriers, higher payouts
Synack is an invite-only bug bounty platform that positions itself as an elite hacker community. Unlike other platforms, Synack requires you to pass a verification process before joining. The platform offers higher base payouts, a steady stream of private programs, and direct relationships with program managers. Synack is best for experienced hunters who can pass the vetting process and want access to exclusive, high-bounty programs.
Synack's entry process is the most rigorous of any bug bounty platform. You must apply, pass a background check, and complete a skills assessment. The process ensures quality but also means less competition once you're in. Synack values professionalism, clear communication, and demonstrated technical skill.
## Synack Vetting Process
**Step 1: Application**
- Submit an application on the Synack website
- Provide your background, experience level, and areas of expertise
- Include links to your LinkedIn, GitHub, or published research
**Step 2: Background Check**
- Synack requires a background check for all researchers
- Must be 18+ and legally eligible to perform security testing
- Criminal background check is standard
**Step 3: Skills Assessment**
- Complete a technical challenge on Synack's test range
- Tests: web application testing, network testing, mobile (optional)
- Must demonstrate ability to find and document vulnerabilities
- Scoring is based on accuracy, completeness, and report quality
**Step 4: Interview (Sometimes)**
- Some candidates are interviewed by the Synack team
- Focus: communication skills, methodology, professionalism
**Step 5: Onboarding**
- Platform orientation
- NDA signing
- Payment setupSynack's 5-step vetting process — what to expect at each stage
## Synack Payout Structure
| Vulnerability Type | Typical Payout | Notes |
|-------------------|-------------------|----------------------------------|
| Critical | $5,000 - $25,000 | RCE, SQLi leading to data access |
| High | $2,000 - $10,000 | SSRF, IDOR, Auth bypass |
| Medium | $500 - $3,000 | XSS, CSRF, Miscategorized bugs |
| Low | $100 - $500 | Information disclosure, missing headers |
**Synack exclusives:**
- 'Red Team' engagements: $500-$2,000/day for penetration testing
- Special bounties: some programs offer bonuses for specific vulnerability types
- Loyalty bonuses: long-term researchers get priority access to new programsSynack payout ranges — typically higher than public platforms
TIPS
Synack researchers enjoy lower competition, higher payouts, and direct program manager access. However, the platform requires consistent activity to maintain your status. Synack has a 'minimum activity' requirement that varies by tier. Inactive researchers may lose access to top programs.
## Synack Researcher Tiers
| Tier | Requirements | Benefits |
|--------|---------------------------------|---------------------------------------------|
| Silver | Pass vetting, active in 30 days | Access to 10-20 programs |
| Gold | 5+ accepted reports, 3 months | Access to 20-50 programs, priority support |
| Platinum | 20+ accepted reports, 1 year | Access to 50+ programs, Red Team invites |
**Maintaining your status:**
- Submit at least 1 report every 30 days
- Respond to triage requests within 48 hours
- Maintain professional communication
- Participate in special projects and Red Team engagements
**Getting kicked out:**
- No activity for 60+ days (automatic suspension)
- Low-quality submissions (multiple N/As)
- Violating program scope or testing guidelinesSynack researcher tiers and activity requirements to maintain access
## Tips for Synack Success
1. **Focus on one program at a time** — Synack programs reward depth over breadth
2. **Build relationships with program managers** — direct communication leads to more invites
3. **Report everything** — even low-severity findings build your reputation on the platform
4. **Use the Synack-provided VPN** — all testing goes through their infrastructure
5. **Request access to Red Team engagements** — these pay daily rates, not per-bug
6. **Check the 'Special Projects' tab** — time-limited projects with bonus payouts
7. **Join the Synack Slack** — community support, tips, and program announcementsStrategies for succeeding on the Synack platform
TIPS
RESOURCES IN THIS CHAPTER
Synack is the premium bug bounty platform with higher barriers to entry but also higher rewards. The vetting process filters out low-quality researchers, meaning less competition. Ideal for experienced hunters who want access to exclusive programs and Red Team engagements.
Free, non-monetary disclosure platform — ideal for beginners and VDP-only programs
OpenBugBounty is a unique platform that focuses on coordinated disclosure rather than monetary rewards. It's completely free — no commissions, no bounties. Researchers submit vulnerabilities and receive credit for their findings. After a 90-day disclosure period, the vulnerability is publicly disclosed (unless the vendor fixes it earlier). OpenBugBounty is excellent for building a track record, collecting CVE IDs, and practicing disclosures without the pressure of bounty competition.
OpenBugBounty operates differently from bounty platforms. There are no bounties — the reward is public credit for your finding. The platform connects researchers with website owners for responsible disclosure. After the 90-day disclosure period, vulnerabilities are published. Researchers build a profile showing their total disclosures, affected sites, and responsible disclosure compliance.
## OpenBugBounty Process
1. **Find a vulnerability** — any web vulnerability (XSS, SQLi, CSRF, etc.)
2. **Submit through OpenBugBounty** — provide the URL, vulnerability details, and PoC
3. **Notification** — OBB contacts the website owner with your report
4. **Mitigation Period (90 days)** — the owner has 90 days to fix the issue
5. **Early fix** — if the owner fixes it before 90 days, disclosure can happen immediately
6. **Public Disclosure** — after 90 days, the vulnerability is published with your credit
**Key differences:**
- No bounties — it's purely for credit and experience
- No competition — multiple researchers can report to the same website
- Focus on coordinated disclosure methodology
- Great for building a public research portfolioOpenBugBounty's disclosure process — step by step
## OpenBugBounty Guidelines
**Do's:**
- Report verified vulnerabilities only
- Provide clear reproduction steps
- Wait the full 90-day disclosure period
- Help the vendor understand the issue if they ask
- Build your profile with consistent quality reports
**Don'ts:**
- Don't report automated scanner findings
- Don't contact vendors directly — use OBB's notification system
- Don't demand payment or bounties (this violates OBB policy)
- Don't report vulnerabilities on sites with active bug bounty programs
- Don't publicly disclose before the 90-day period ends
**Scope:**
- Any publicly accessible website
- All standard web vulnerabilities
- No network-level or physical security issues
- No vulnerabilities requiring authentication (unless you have authorized access)OpenBugBounty guidelines — what's allowed and what's not
TIPS
Your OpenBugBounty profile shows your total disclosed vulnerabilities, the types of bugs you've found, and your disclosure compliance rate. A strong OBB profile demonstrates responsible disclosure practices and technical competence. Many researchers use their OBB profile as a reference when applying to paid programs or security jobs.
## Optimizing Your OBB Profile
**Profile elements:**
- Full name or pseudonym (consistent across platforms)
- Biography: your focus areas and experience level
- Stats: total disclosures, types of bugs, compliance rate
- External links: Twitter, LinkedIn, GitHub
**Stats that matter:**
- Total disclosed vulnerabilities: 50+ shows consistent activity
- Compliance rate: 95%+ (never violate the disclosure period)
- Vulnerability diversity: XSS, CSRF, SQLi, IDOR, etc.
- Response rate: high rate of vendor fixes indicates quality reports
**Progression path:**
1. Start with 10-20 OBB disclosures to learn the process
2. Move to VDPs on HackerOne/Bugcrowd for structured programs
3. Graduate to paid bounty programs with a proven track record
4. Use your OBB + paid program history when applying to SynackHow to optimize your OpenBugBounty researcher profile
## Getting CVEs Through OpenBugBounty
Some OBB disclosures qualify for CVE assignment:
1. The vulnerability must be a distinct security issue (not a duplicate)
2. The vendor must acknowledge the issue (fixing it counts as acknowledgment)
3. Submit CVE request through MITRE or your preferred CNA
4. Reference the OBB disclosure ID in your CVE request
**Tips:**
- SQL injection, RCE, and authentication bypasses are most likely to get CVEs
- XSS rarely gets CVEs unless it's stored and affects a significant application
- Having CVEs on your profile significantly boosts your credibility as a researcherHow to get CVE IDs for your OpenBugBounty disclosures
TIPS
RESOURCES IN THIS CHAPTER
OpenBugBounty is the best platform for beginners and researchers who want to practice responsible disclosure without the pressure of paid bounties. Build your profile, collect CVEs, and use the experience as a stepping stone to paid platforms.