3 of 7Bug bounty & vulnerability research
Vulnerability research for the bugs scanners miss.
Automated scanners are good at known patterns. The flaws behind real breaches are usually broken business logic, weak access control and chains of small issues. We hunt for those by hand, and we help you set up a disclosure program so outside researchers can tell you what they find.
What we cover
Manual vulnerability research
Hands-on review of the features attackers care about most: sign-in, payments, permissions and data exports.
Vulnerability disclosure programs and security.txt
A clear policy, safe-harbour wording and a security.txt file, so researchers know how to reach you.
Bug bounty program design and triage
Scope, rewards and rules for a public or private program, plus triage so your engineers only see valid reports.
Severity scoring with CVSS
Consistent, defensible severity ratings that turn reports into a backlog in the right order.
Coordinated disclosure with vendors
When we find a flaw in third-party software, we report it to the vendor and agree on timing before anything is published.
Variant analysis after a finding
A bug is rarely alone. We look for the same mistake everywhere else in your code.
How an engagement runs
Scope the targets
We agree on applications, test accounts, and what is in and out of bounds.
Research
Manual testing focused on logic, access control and chained issues.
Report as we go
Each finding arrives with proof, a CVSS severity and a suggested fix.
Set up your program
If you want one: policy, security.txt, intake and triage for an ongoing disclosure or bounty program.
What you get
- Findings with proof and CVSS severity
- A suggested fix for each issue
- A disclosure policy and security.txt ready to publish
- A triage process for incoming reports
- Variant checks across your code base
Standards
CVSS scoring, RFC 9116 for security.txt, and ISO/IEC 29147 and 30111 for vulnerability disclosure and handling.
Questions people ask
What is the difference between a pentest and a bug bounty?
A penetration test is a time-boxed test by a known team against an agreed scope. A bug bounty pays outside researchers for valid findings over time. Many companies start with a pentest, then add a disclosure program.
Do we need a bug bounty to accept reports?
No. A vulnerability disclosure policy and a security.txt file let researchers report issues without any payment program. Rewards can come later.
Will a bounty program flood us with noise?
It can, which is why triage matters. We filter duplicates and invalid reports, so your engineers only see real issues.
Contact
Tell us what you want looked at.
A few lines is enough to start. We’ll reply with questions or a time to talk.