How to Pick Bug Bounty Programs Worth Your Time
Hunters burn months on the wrong programs. Brand recognition feels productive. It usually is not. You want a target where your skills meet live assets, clear rules, and a triage team that still reads reports.
Start with fit, not fame.
Read the policy like a contract
Open scope, in-scope wildcards, and explicit out-of-scope lists before you create an account. Note rate limits, social-engineering bans, and whether DoS is rewarded or instantly rejected. If the policy is vague on authz testing or "third-party services," expect friction later.
Check when the policy was last updated. A stale page with dead domains is a warning. A recent changelog that added a new API or mobile app is a signal.
Also skim resolved reports if the program publishes them. Patterns tell you what already got paid and what triage still cares about. A wall of self-XSS closures tells you the program is noisy on that class—move your effort elsewhere unless you have a novel chain.
Match assets to what you actually hunt
If you are strong on IDOR and multi-tenant SaaS, prefer programs with clear role models and documented APIs. If you live in mobile deep links or Electron IPC, skip the pure marketing site with a contact form.
Ask three practical questions:
- Can I create two test accounts without waiting a week?
- Is there a staging or sandbox that is in scope?
- Do assets change often enough that stale public writeups are less likely to cover everything?
A small fintech with a noisy GraphQL surface can pay better hours than a giant consumer app that has been scraped for five years. Check whether the program supplies test credit cards, sample tenants, or invite codes. Friction at signup is friction every single day you hunt.
Payouts and response quality beat max bounty screenshots
A "$50,000 max" banner means little if average valid reports sit at $100 and triage takes a month. Look at average bounty ranges, first-response time, and whether duplicates are handled fairly. Programs that reward clear impact with consistent severity mapping are easier to plan around.
I've walked away from high-max programs after two slow, contradictory triage cycles. Time is the scarce resource. Prefer a mid-range program that answers in three days over a prestige logo that ghosts you for six weeks.
Build a shortlist, not a wishlist
Keep five to eight active programs. One "main" with deep product knowledge, two secondary for when you stall, and a couple of private or new launches for novelty. Rotate when you stop finding fresh attack surface.
Recon every shortlist member quarterly: new subdomains, new mobile builds, new docs portals. Freshness beats nostalgia. Track your hours per valid report for a month. The spreadsheet is blunt, but it ends arguments with yourself about "one more day" on a dead target.
Watch for programs that suddenly expand scope to APIs or mobile after years of web-only hunting. Those windows are where experienced hunters concentrate for a quarter, then leave when the surface stabilizes again.
Picking well is half the methodology. The other half is quitting targets that stopped teaching you something.