Glossary
What Is a Bug Bounty Program?
A bug bounty program rewards external security researchers for finding and responsibly disclosing vulnerabilities. The reward structure (typically tiered by severity, from a few hundred euros for low-severity to tens of thousands for critical RCE) creates ongoing crowdsourced security testing. Programs run on platforms (HackerOne, Bugcrowd, Intigriti, YesWeHack) or self-hosted.
Bug bounty vs penetration test
- Pentest: time-bounded, coverage-driven, comprehensive, single-engagement, in-house or contracted firm. Output: comprehensive report.
- Bug bounty: ongoing, opportunistic, partial-coverage, many independent researchers, pay-on-validated-finding. Output: stream of valid findings.
They're complementary, not substitutes. Pentest establishes baseline + compliance evidence; bug bounty catches what humans missed and surfaces novel exploits as your surface evolves.
When you should NOT run a public bug bounty (yet)
- Before doing baseline pentesting — you'll be flooded with already-known issues
- If your security team can't triage incoming reports promptly (disclose.io recommends <5 business days first response)
- Without a vulnerability-disclosure policy (VDP) defining scope, rewards, safe harbour
- Without engineering bandwidth to fix valid findings within reasonable SLAs
Vulnerability Disclosure Policy (VDP) as the lighter alternative
VDP = published security contact + safe-harbour language for researchers, without paid rewards. Easier to operate, easier to start with. See our SQUR security policy as an example VDP. ISO 30111 + ISO 29147 are the international standards for vulnerability handling and disclosure.
How SQUR fits
SQUR autonomous pentest is the "baseline coverage + compliance evidence" tier. After SQUR (and any baseline manual pentesting), bug-bounty programs catch the long-tail finds that emerge as the application changes. We refer customers to HackerOne and Intigriti for program setup.
Frequently asked questions
How much do bounties pay?
Wide range. HackerOne's 2024 industry report: low-severity median ~€100, critical median ~€5,000. Top programs (Google, Apple, US DoD) pay six figures for critical. Most B2B SaaS programs run in the €500-5,000 range for criticals.
Is bug bounty acceptable for DORA / NIS2 / ISO 27001?
As a supplementary control, yes. As a substitute for pentesting — no. Auditors look for scheduled testing with documented scope; bug bounty is unscheduled and self-selected by researchers. Both controls together are the strongest posture.