A bug bounty platform is a website that connects a company with a crowd of checked outside hackers, and pays them a reward for each security flaw they find. The reward is called a bug bounty. The hackers are often called security researchers. They attack the company with its permission, and only within the rules it sets.
A company starts a programme by writing a policy. The policy lists what may be tested, such as the website and the app. It lists what may not be tested, such as the systems of its partners. It lists what is forbidden, such as reading real customers' data or slowing the service down. And it sets the rewards, by how serious the flaw is.
The platform handles everything in between. It checks the researchers' identities and keeps a record of their past work. It receives each report. Its own team checks that the flaw is real and has not already been reported. This check is called triage. Only then does the company's team see the report. The platform also pays the researchers, who may live in many countries, and handles their tax forms.
Imagine an online learning company in Chandigarh that opens a programme. It offers ₹5,000 for a low-severity flaw, ₹25,000 for a medium one, ₹1 lakh for a high one and ₹2.5 lakh for a critical one. In the second month, a researcher finds a flaw in the password reset page. By changing one hidden field in the request, she can set a new password for any student's account. She reports it with the exact steps. The platform's team repeats the steps and confirms the flaw within a day. The company fixes it in three days, and the researcher confirms that the fix works. A real attacker could have taken over every student's account, so the flaw is rated critical. The company pays her ₹2.5 lakh.
Why pay strangers? A company's own testers spend a fixed number of days on each test. Hundreds of researchers, each trying different ideas, find flaws that a small team misses. And the company pays only for results, not for hours.
The same platforms also run vulnerability disclosure programmes. A vulnerability disclosure programme is a safe, public channel through which anyone can report a flaw, even without a reward. In India, CERT-In, the government's cyber security agency, also accepts reports of flaws in Indian systems.
The reports go into the company's application security posture management (ASPM) tool, next to the findings from its own scanners. A flaw in a bought product, rather than in the company's own code, is matched with the vulnerability scanner's records. Bug bounties are one of the four methods of offensive security testing. They work best next to penetration testing, which covers the whole app in a planned way, while the crowd finds what the plan missed.