Skip to main content

01. Overview & Bug Bounty Ecosystem

Bug Bounty programs allow ethical security researchers to report security vulnerabilities to organizations in exchange for recognition or financial rewards.

[!TIP] Industry Best Practice: Always align this domain with standard frameworks like OWASP, NIST, or CIS benchmarks for optimal security posture.

1. Vulnerability Rating Taxonomy (VRT)

Bugcrowd's VRT and HackerOne's Taxonomy categorize findings by impact:

┌─────────────────────────────────────────────────────────────────────────────┐
│                    Bug Bounty Severity Hierarchy                            │
├──────────┬──────────────────────────────────────────────────────────────────┤
│ P1 - Critical │ Unauthenticated RCE, BOLA/IDOR exposing full DB, Auth Bypass │
│ P2 - High     │ Stored XSS, Blind SSRF, Account Takeover (ATO)               │
│ P3 - Medium   │ Reflected XSS, CSRF on sensitive actions, CORS Misconfig    │
│ P4 - Low      │ Information Disclosure, Missing Security Headers            │
│ P5 - Info     │ Informational findings, out-of-scope issues                  │
└──────────┴──────────────────────────────────────────────────────────────────┘

2. Rules of Engagement (RoE) & Scope Ethics

In-Scope vs Out-of-Scope: Only test assets explicitly listed as In-Scope.
No Data Destruction: Do not delete, modify, or corrupt user data.
Privacy Preservation: If sensitive PII is accessed, stop immediately and report.

Next Chapter: 02. Asset Discovery & Scope Mapping →

1. Vulnerability Rating Taxonomy (VRT)
2. Rules of Engagement (RoE) & Scope Ethics