Glossary

Bug bounty

A program that pays external researchers for valid vulnerability reports within a published scope and rules. It adds rewards to a vulnerability disclosure policy rather than replacing it, and it only helps when the team can triage and fix what arrives.

Defined in: OWASP Vulnerability Disclosure Cheat Sheet: bug bounty programs

Covered in

Guide

Start with a VDP, then add bug bounties and penetration tests

Publish a vulnerability disclosure policy and security.txt first, add a bug bounty only when you can triage and fix at the pace rewards bring, and buy penetration tests with a written scope, rules of engagement and a retest.