Bug Bounties 

Share

Latest news on bug bounties (bug bounty programmes and programs), covering vulnerability disclosure, responsible disclosure, vulnerability rewards, HackerOne, Bugcrowd, Intigriti, bug hunters, ethical hackers, security researchers, penetration testing and zero-day reports.

A bug bounty is an offer by a company, software project or government to reward independent security researchers who find and report flaws. Rewards range from public thanks and merchandise to large cash payments, depending on severity. Platforms such as HackerOne, Bugcrowd and Intigriti connect organisations with researchers and help check reports. Technology firms, open source projects and blockchain teams all run programmes.

Artificial intelligence is now reshaping the field. In January 2026 the curl project ended its bug bounty after a flood of low-quality, AI-generated reports. From 1 October 2026 Google paused product vulnerability submissions to its open source rewards programme, saying most automated submissions were invalid. Some researchers argue that AI tools also help find genuine flaws.

Clear rules matter to both sides. A programme sets out which systems are in scope, how severity is judged and how much each finding earns. Many add safe harbour wording, promising not to pursue testers who act in good faith. A security.txt file, described in RFC 9116, tells researchers where to send a report.

Bug hunting is a global community of ethical hackers, students and professional penetration testing specialists. Many build skills through capture-the-flag contests and public write-ups. Critics say rewards can be small next to the effort involved, and disputes over duplicates, scope and severity are common. Supporters say bounties widen the pool of people testing software.

Netscape ran an early bug bounty for its Navigator 2.0 beta in 1995, and Mozilla offered a cash reward for Firefox flaws in 2004. Google began paying rewards for Chromium flaws in 2010, then extended the idea to its web services in November 2010. In 2016 the US Department of Defense ran Hack the Pentagon, the first bug bounty run by the US federal government.

Staying informed helps researchers and defenders alike. Our NewsNow bug bounty news feed gathers the latest headlines on bug bounties, HackerOne, Bugcrowd, vulnerability disclosure, bug hunters and security researchers from reliable sources worldwide, so you have a comprehensive, up-to-date view.