Bug Bounty Hunting Essentials
上QQ阅读APP看书,第一时间看更新

Reward and qualifications

This section outlines the expected rewards with respect to the vulnerabilities in a tabular form. The sections contain the category of the vulnerabilities and the reward for core applications and non-core applications. The payout ranges are listed in this section to give an idea to the researcher of what to expect in regards to which vulnerability.

This is to notify the researchers what to expect from a vulnerability and the vulnerabilities that are rewarded higher than others. Setting this benchmark allows the program owners to justify their rewards after they have resolved a vulnerability and it reduces the chances of debate in the process.

This image shows a sample bounty division that is displayed in Salesforce