Bug bounty programs in Cybersecurity - Mini Project: Build & Apply

Understanding Bug Bounty Programs

📖 Scenario: You are learning about cybersecurity and want to understand how companies find and fix security problems. Bug bounty programs are one way companies invite people to find bugs in their software and get rewards.

🎯 Goal: Build a simple list of bug bounty programs, add a reward threshold, filter programs by reward, and finalize the list for sharing.

📋 What You'll Learn

Create a dictionary of bug bounty programs with exact names and reward amounts

Add a reward threshold variable to filter programs

Use a dictionary comprehension to select programs with rewards above the threshold

Add a final note about the filtered programs

💡 Why This Matters

🌍 Real World

Bug bounty programs help companies find security problems by inviting ethical hackers to test their software and report bugs for rewards.

💼 Career

Understanding bug bounty programs is useful for cybersecurity roles, ethical hacking, and software security testing.

1

Create the bug bounty programs dictionary

Create a dictionary called bug_bounty_programs with these exact entries: 'AcmeCorp': 5000, 'CyberSafe': 3000, 'SecureNet': 7000, 'DataShield': 2000, and 'NetGuard': 4500.

Cybersecurity

# Create the bug_bounty_programs dictionary with exact entries
# Your code here

Hint

Use curly braces to create a dictionary with the exact company names as keys and reward amounts as values.

2

Add a reward threshold variable

Add a variable called reward_threshold and set it to 4000.

Cybersecurity

bug_bounty_programs = {
    'AcmeCorp': 5000,
    'CyberSafe': 3000,
    'SecureNet': 7000,
    'DataShield': 2000,
    'NetGuard': 4500
}
# Add the reward_threshold variable below
# Your code here

Hint

Just create a variable with the exact name and assign the number 4000 to it.

3

Filter programs with rewards above the threshold

Use a dictionary comprehension to create a new dictionary called high_reward_programs that includes only the entries from bug_bounty_programs where the reward is greater than reward_threshold. Use program and reward as the loop variables.

Cybersecurity

bug_bounty_programs = {
    'AcmeCorp': 5000,
    'CyberSafe': 3000,
    'SecureNet': 7000,
    'DataShield': 2000,
    'NetGuard': 4500
}
reward_threshold = 4000
# Create high_reward_programs dictionary below
# Your code here

Hint

Use dictionary comprehension with program, reward in bug_bounty_programs.items() and filter with if reward > reward_threshold.

4

Add a final note about the filtered programs

Add a variable called final_note and set it to the string 'Programs with rewards above 4000 are listed.'

Cybersecurity

bug_bounty_programs = {
    'AcmeCorp': 5000,
    'CyberSafe': 3000,
    'SecureNet': 7000,
    'DataShield': 2000,
    'NetGuard': 4500
}
reward_threshold = 4000
high_reward_programs = {program: reward for program, reward in bug_bounty_programs.items() if reward > reward_threshold}
# Add final_note variable below
# Your code here

Hint

Just assign the exact string to the variable final_note.

Practice

1. What is the main purpose of a bug bounty program?

easy

A. To create marketing campaigns for new apps

B. To sell software products to customers

C. To train employees on coding skills

D. To encourage people to find and report security bugs

Solution

1. Step 1: Understand the goal of bug bounty programs

   Bug bounty programs invite external people to find security bugs safely.

2. Step 2: Identify the main purpose

   The main goal is to find and report security bugs to improve software safety.

3. Final Answer:

   To encourage people to find and report security bugs -> Option D

4. Quick Check:

   Bug bounty = find and report bugs [OK]

Hint: Bug bounty = find bugs and get rewarded [OK]

Common Mistakes:

• Confusing bug bounty with marketing or sales
• Thinking it's for employee training
• Assuming it's about product selling

2. Which of the following is a correct rule in most bug bounty programs?

easy

A. Report bugs only through official channels

B. Share bugs publicly before reporting

C. Hack any system without permission

D. Ignore program scope and test everything

Solution

1. Step 1: Review common bug bounty rules

   Participants must report bugs only through official channels to keep things safe and organized.

2. Step 2: Eliminate incorrect options

   Hacking without permission, sharing bugs publicly early, or ignoring scope are against rules.

3. Final Answer:

   Report bugs only through official channels -> Option A

4. Quick Check:

   Official reporting = correct rule [OK]

Hint: Always report bugs via official program channels [OK]

Common Mistakes:

• Thinking hacking without permission is allowed
• Sharing bugs publicly before reporting
• Ignoring program scope rules

3. A bug bounty program offers $500 for a valid report. If a participant finds 3 valid bugs, what is their total reward?

medium

A. $1500

B. $1000

C. $500

D. $2000

Solution

1. Step 1: Understand the reward per bug

   Each valid bug report earns $500.

2. Step 2: Calculate total reward for 3 bugs

   3 bugs x $500 = $1500 total reward.

3. Final Answer:

   $1500 -> Option A

4. Quick Check:

   3 x 500 = 1500 [OK]

Hint: Multiply bugs found by reward per bug [OK]

Common Mistakes:

• Adding instead of multiplying
• Confusing total reward with single bug reward
• Choosing wrong multiplication result

4. A participant reports a bug outside the program scope. What is the likely outcome?

medium

A. The bug will be rewarded fully

B. The program will expand its scope immediately

C. The report will be ignored or rejected

D. The participant will get a bonus reward

Solution

1. Step 1: Understand program scope importance

   Bug bounty programs define scope to focus on specific areas.

2. Step 2: Outcome of out-of-scope reports

   Reports outside scope are usually ignored or rejected as they are not part of the program.

3. Final Answer:

   The report will be ignored or rejected -> Option C

4. Quick Check:

   Out-of-scope bugs = rejected reports [OK]

Hint: Only bugs inside scope get rewarded [OK]

Common Mistakes:

• Assuming all bugs get rewarded
• Thinking scope expands automatically
• Expecting bonus for out-of-scope bugs

5. A company wants to start a bug bounty program but worries about receiving too many invalid reports. What is a good way to reduce invalid submissions?

hard

A. Allow anyone to submit any kind of report

B. Set clear rules and scope for the program

C. Ignore all reports from new participants

D. Pay rewards even for invalid reports

Solution

1. Step 1: Identify how to control report quality

   Clear rules and scope help participants know what to test and report.

2. Step 2: Evaluate options to reduce invalid reports

   Setting clear rules reduces confusion and invalid submissions effectively.

3. Final Answer:

   Set clear rules and scope for the program -> Option B

4. Quick Check:

   Clear rules = fewer invalid reports [OK]

Hint: Clear rules guide valid bug reports [OK]

Common Mistakes:

• Allowing any report causes many invalids
• Ignoring new participants is unfair
• Paying invalid reports wastes resources