When to Stop Hunting a Target (Before It Stops You)
Stopping is a skill. Platforms never toast you for leaving a program. Your bank account and your sleep might.
The myth says persistence always wins. Persistence on a dead asset mostly produces duplicates, scope violations, and a bad mood you take into the next hunt.
Hard stop signals
Walk when several of these stack:
- Same classes of bugs keep coming back as duplicates within minutes of filing
- Scope is a marketing site plus a locked SSO you cannot get a test seat for
- Triage response times measured in geological eras with no signal either way
- Every interesting host is explicitly out of scope or pure third-party
- You are only finding self-XSS and verbose 404s after serious, structured effort
- The program quietly narrowed scope or dropped bounty ranges without saying so in a place you noticed
One slow week is noise. A pattern across two or three focused boxes is data. Trust the data.
Soft stop signals (personal)
You dread opening the proxy for that brand. You reread the same endpoint notes without a new hypothesis. You are hunting to avoid starting a harder, better-scoped program — or to avoid writing the report you already owe triage.
That emotional sludge costs more than a clean break.
Also stop — temporarily — if you are sick, furious after an unfair N/A, or sleep-deprived. Angry testing produces scope violations, reckless automation, and sloppy reports that stain your handle.
Skill mismatch is a soft stop too. If the target is all thick-client reverse engineering and you are a web person this quarter, leave. Come back when your skills match the surface.
How to leave cleanly
Export your notes. Mark parked threads with reasons. If you have an open report, finish communication professionally — silence after "please retest" is how you burn a relationship.
Unfollow program noise channels that keep pulling you back into doom-scrolling changelogs. Optionally write a private postmortem: what the auth model was, what you skipped, what skill gap showed up. That page makes the hours reusable even if the bounty never arrived.
What "stop" is not
It is not deleting your career. It is reallocating attention to a target where your current skills have leverage — maybe fewer hunters, clearer APIs, or a niche you already know (GraphQL, mobile, Salesforce, Kubernetes, whatever your edge is).
Come back later if the program ships a new app, opens a proper test environment, or your skills level up. Targets change. So do you.
Guilt is the trap. Leaving a famous brand feels like giving up. It is usually just target selection with adult numbers attached. Famous does not mean profitable for your skill set this quarter.
Keep a short "do not return until" note: new API shipped, test seats available, or a skill you plan to learn. That turns quitting into a deferred plan.
The hunters who last are not the ones who never quit a host. They are the ones who quit on purpose and aim the next hour where it can land.