Step-by-Step Study Guide

Step 1: What is a Bug Bounty Program?

A bug bounty program is a structured system where:

• Organizations invite security researchers (ethical hackers) to find vulnerabilities
• Researchers report findings responsibly instead of exploiting them
• Organizations reward valid reports with money ("bounties") or recognition

Key Concept: Responsible Disclosure

Rather than publicly exposing a vulnerability, researchers report it privately to the organization first, giving them time to fix it.

---

Step 2: Private vs. Public Programs

Vercel's Journey

2022 → Private program (HackerOne VIP)
     → Thousands of vetted researchers
     → Refined processes
     
Now  → Single unified PUBLIC program

---

Step 3: Why Organizations Go Public

Vercel's reasoning teaches us the tradeoffs organizations consider:

Reasons TO go public:

• ✅ More researchers = more vulnerabilities found
• ✅ Reports evaluated on merit, not researcher status
• ✅ Wider community strengthens security

Reasons AGAINST going public:

• ⚠️ Higher volume of invalid reports (noise)
• ⚠️ Requires more internal resources to triage
• ⚠️ AI tools now generate mass automated submissions

How Vercel Solved the Noise Problem:

They built custom tooling to filter noise and streamline triage before going public — an important lesson: scale your processes before scaling access

---

Step 4: The Role of AI in Modern Bug Bounties

This is a new and important dynamic to understand:

AI Impact on Bug Bounty Programs
├── More researchers can find vulnerabilities (lower skill barrier)
├── More reports submitted overall
├── Both VALID and INVALID reports increase
└── Organizations must choose:
    ├── Go private (reduce noise) ← Some companies
    └── Go public + build better filters ← Vercel's choice

Key Insight: AI democratizes security research — both a challenge and an opportunity.

---

Step 5: How a Bug Bounty Platform Works (HackerOne)

HackerOne is a third-party platform that:

1. Hosts the bounty program
2. Manages researcher identities and reputation
3. Facilitates secure report submission
4. Tracks disclosure and remediation progress

The Submission Process:

Researcher finds vulnerability
        ↓
Submit report on HackerOne
(with clear reproduction steps)
        ↓
Security team triages report
        ↓
Valid? → Fix developed & shipped
        ↓
Researcher rewarded + fix verified

---

Step 6: Scope — What Can Be Tested?

Scope defines the boundaries of what researchers are allowed to test.

Vercel's Scope Includes:

• All Vercel platform products
• All open-source projects

Why Scope Matters:

• Testing outside scope = potentially illegal
• Clear scope protects both the researcher and the organization
• Always read the scope page before testing anything

---

Step 7: How to Participate as a Researcher

Checklist for Participating in Any Bug Bounty:

• Read the full program scope
• Understand what is and isn't allowed
• Find a genuine vulnerability
• Write clear reproduction steps
• Submit through the designated platform
• Communicate transparently during disclosure
• Never exploit or publicly disclose before a fix

---

Summary: Core Concepts Learned

---

Quick Knowledge Check

Ask yourself:

1. What is the difference between a private and public bug bounty program?
2. Why did AI increase the challenge of managing bug bounty programs?
3. What should you always read before testing a company's systems?
4. What makes a good vulnerability report?
5. Why do organizations use platforms like HackerOne instead of managing programs themselves?