Bug Bounty Program

A Bug Bounty Program (BBP), also referred to as a vulnerability rewards program, is a crowdsourcing initiative offered by websites, organizations, and software developers that rewards individuals for discovering and reporting software bugs. Individuals who discover bugs can receive recognition and even compensation, especially those who report security exploits or vulnerabilities.

The purpose of a bug bounty program is to allow developers to resolve bugs before the general public is aware of them and to supplement internal code audits and penetration tests. Well-known companies such as Mozilla, Facebook, Google, and Microsoft have implemented BBPs. A bug report must document enough information in order for the program to be able to reproduce the vulnerability. The amount of compensation paid depends on the size of the organization, difficulty in hacking the system, and how much impact the bug has.

A BBP uses ethical hacking, which is the legal hacking of a computer system to identify areas where organizations can improve. Companies such as the United States Department of Defense and other government agencies have started using BBPs. This is a reversal from previously threatening ethical hackers with legal recourse to now inviting them to participate.

Bug bounty program disadvantages

While bug bounties can be effective, they can also be controversial. While most companies complete a full background check on the testers they allow into their program, the issue of trust still arises. To limit potential risk, some organizations have BBPs that require an invitation. Apple has limited bug bounty participation to a few dozen researchers.

A large disadvantage is the lack of relationship BBP testers have with a company. They do not partner with a company over time, so results are not tailored to match the company’s security initiatives or level of risk.

Webopedia Staff
Webopedia Staff
Since 1995, more than 100 tech experts and researchers have kept Webopedia’s definitions, articles, and study guides up to date. For more information on current editorial staff, please visit our About page.
Get the Free Newsletter
Subscribe to Daily Tech Insider for top news, trends & analysis
This email address is invalid.
Get the Free Newsletter
Subscribe to Daily Tech Insider for top news, trends & analysis
This email address is invalid.

Related Articles

Virtual Private Network (VPN)

A virtual private network (VPN) encrypts a device's Internet access through a secure server. It is most frequently used for remote employees accessing a...

Gantt Chart

A Gantt chart is a type of bar chart that illustrates a project schedule and shows the dependency between tasks and the current schedule...

Input Sanitization

Input sanitization is a cybersecurity measure of checking, cleaning, and filtering data inputs from users, APIs, and web services of any unwanted characters and...

IT Asset Management Software

IT asset management software (ITAM software) is an application for organizing, recording, and tracking all of an organization s hardware and software assets throughout...


ScalaHosting is a leading managed hosting provider that offers secure, scalable, and affordable...


Human resources information system (HRIS) solutions help businesses manage multiple facets of their...

Best Managed Service Providers...

In today's business world, managed services are more critical than ever. They can...