Bug Bounty Program

A Bug Bounty Program (BBP), also referred to as a vulnerability rewards program, is a crowdsourcing initiative offered by websites, organizations, and software developers that rewards individuals for discovering and reporting software bugs. Individuals who discover bugs can receive recognition and even compensation, especially those who report security exploits or vulnerabilities.

The purpose of a bug bounty program is to allow developers to resolve bugs before the general public is aware of them and to supplement internal code audits and penetration tests. Well-known companies such as Mozilla, Facebook, Google, and Microsoft have implemented BBPs. A bug report must document enough information in order for the program to be able to reproduce the vulnerability. The amount of compensation paid depends on the size of the organization, difficulty in hacking the system, and how much impact the bug has.

A BBP uses ethical hacking, which is the legal hacking of a computer system to identify areas where organizations can improve. Companies such as the United States Department of Defense and other government agencies have started using BBPs. This is a reversal from previously threatening ethical hackers with legal recourse to now inviting them to participate.

Bug bounty program disadvantages

While bug bounties can be effective, they can also be controversial. While most companies complete a full background check on the testers they allow into their program, the issue of trust still arises. To limit potential risk, some organizations have BBPs that require an invitation. Apple has limited bug bounty participation to a few dozen researchers.

A large disadvantage is the lack of relationship BBP testers have with a company. They do not partner with a company over time, so results are not tailored to match the company’s security initiatives or level of risk.

Webopedia Staff
Webopedia Staff
Since 1995, more than 100 tech experts and researchers have kept Webopedia’s definitions, articles, and study guides up to date. For more information on current editorial staff, please visit our About page.

Related Articles

Human Resources Management System

A Human Resources Management System (HRMS) is a software application that supports many functions of a company's Human Resources department, including benefits administration, payroll,...

How To Defend Yourself Against Identity Theft

Almost every worldwide government agency responsible for identity theft issues will tell you the same thing: The first step to fighting identity theft is...

Infographic

An infographic is a visual representation of information or data. It combines the words information and graphic and includes a collection of imagery, charts,...

Phishing

What is phishing? Phishing is a type of cybercrime in which victims are contacted by email, telephone, or text message by an attacker posing as...

ScalaHosting

ScalaHosting is a leading managed hosting provider that offers secure, scalable, and affordable...

HRIS

Human resources information system (HRIS) solutions help businesses manage multiple facets of their...

Best Managed Service Providers...

In today's business world, managed services are more critical than ever. They can...