Bug bounty programs in Cybersecurity - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a bug bounty program?

A bug bounty program is an initiative where organizations invite security researchers to find and report software bugs, especially security vulnerabilities, in exchange for rewards or recognition.

beginner

Why do companies run bug bounty programs?

Companies run bug bounty programs to improve their security by finding vulnerabilities before attackers do, saving money on fixing issues early, and building trust with users.

beginner

Who can participate in bug bounty programs?

Anyone with security skills can participate, from professional security researchers to hobbyists, as long as they follow the program's rules and report bugs responsibly.

intermediate

What types of bugs are usually rewarded in bug bounty programs?

Typically, security vulnerabilities like code injection, cross-site scripting, broken authentication, and data leaks are rewarded because they pose risks to users and systems.

intermediate

What is responsible disclosure in bug bounty programs?

Responsible disclosure means reporting bugs privately to the company first, giving them time to fix the issue before making it public, to protect users from harm.

What is the main goal of a bug bounty program?

A To find and fix security bugs before attackers do

B To sell software products

C To hire new employees

D To advertise new features

Bug bounty programs focus on finding security bugs early to protect systems and users.

Who usually receives rewards in bug bounty programs?

A All users of the software

B Security researchers who report valid bugs

C Company executives

D Marketing teams

Rewards go to those who find and report valid security issues.

What does responsible disclosure mean?

A Ignoring bugs found

B Sharing bugs on social media immediately

C Selling bugs to competitors

D Reporting bugs privately before public announcement

Responsible disclosure protects users by allowing companies to fix bugs before public exposure.

Which of these is a common type of bug rewarded in bug bounty programs?

A Slow internet connection

B Typo in user manual

C Cross-site scripting (XSS)

D Missing logo on website

Cross-site scripting is a security vulnerability often rewarded in bug bounty programs.

Why might a company prefer a bug bounty program over hiring only internal testers?

A It taps into a wide community of diverse security experts

B It reduces the number of users

C It increases software price

D It limits feedback to only employees

Bug bounty programs leverage many external experts, increasing chances to find bugs.

Explain what a bug bounty program is and why it is important for cybersecurity.

Think about how companies use outside help to improve security.

Describe the concept of responsible disclosure and why it matters in bug bounty programs.

Consider the timing of sharing bug information.

Practice

1. What is the main purpose of a bug bounty program?

easy

A. To create marketing campaigns for new apps

B. To sell software products to customers

C. To train employees on coding skills

D. To encourage people to find and report security bugs

Solution

1. Step 1: Understand the goal of bug bounty programs

   Bug bounty programs invite external people to find security bugs safely.

2. Step 2: Identify the main purpose

   The main goal is to find and report security bugs to improve software safety.

3. Final Answer:

   To encourage people to find and report security bugs -> Option D

4. Quick Check:

   Bug bounty = find and report bugs [OK]

Hint: Bug bounty = find bugs and get rewarded [OK]

Common Mistakes:

• Confusing bug bounty with marketing or sales
• Thinking it's for employee training
• Assuming it's about product selling

2. Which of the following is a correct rule in most bug bounty programs?

easy

A. Report bugs only through official channels

B. Share bugs publicly before reporting

C. Hack any system without permission

D. Ignore program scope and test everything

Solution

1. Step 1: Review common bug bounty rules

   Participants must report bugs only through official channels to keep things safe and organized.

2. Step 2: Eliminate incorrect options

   Hacking without permission, sharing bugs publicly early, or ignoring scope are against rules.

3. Final Answer:

   Report bugs only through official channels -> Option A

4. Quick Check:

   Official reporting = correct rule [OK]

Hint: Always report bugs via official program channels [OK]

Common Mistakes:

• Thinking hacking without permission is allowed
• Sharing bugs publicly before reporting
• Ignoring program scope rules

3. A bug bounty program offers $500 for a valid report. If a participant finds 3 valid bugs, what is their total reward?

medium

A. $1500

B. $1000

C. $500

D. $2000

Solution

1. Step 1: Understand the reward per bug

   Each valid bug report earns $500.

2. Step 2: Calculate total reward for 3 bugs

   3 bugs x $500 = $1500 total reward.

3. Final Answer:

   $1500 -> Option A

4. Quick Check:

   3 x 500 = 1500 [OK]

Hint: Multiply bugs found by reward per bug [OK]

Common Mistakes:

• Adding instead of multiplying
• Confusing total reward with single bug reward
• Choosing wrong multiplication result

4. A participant reports a bug outside the program scope. What is the likely outcome?

medium

A. The bug will be rewarded fully

B. The program will expand its scope immediately

C. The report will be ignored or rejected

D. The participant will get a bonus reward

Solution

1. Step 1: Understand program scope importance

   Bug bounty programs define scope to focus on specific areas.

2. Step 2: Outcome of out-of-scope reports

   Reports outside scope are usually ignored or rejected as they are not part of the program.

3. Final Answer:

   The report will be ignored or rejected -> Option C

4. Quick Check:

   Out-of-scope bugs = rejected reports [OK]

Hint: Only bugs inside scope get rewarded [OK]

Common Mistakes:

• Assuming all bugs get rewarded
• Thinking scope expands automatically
• Expecting bonus for out-of-scope bugs

5. A company wants to start a bug bounty program but worries about receiving too many invalid reports. What is a good way to reduce invalid submissions?

hard

A. Allow anyone to submit any kind of report

B. Set clear rules and scope for the program

C. Ignore all reports from new participants

D. Pay rewards even for invalid reports

Solution

1. Step 1: Identify how to control report quality

   Clear rules and scope help participants know what to test and report.

2. Step 2: Evaluate options to reduce invalid reports

   Setting clear rules reduces confusion and invalid submissions effectively.

3. Final Answer:

   Set clear rules and scope for the program -> Option B

4. Quick Check:

   Clear rules = fewer invalid reports [OK]

Hint: Clear rules guide valid bug reports [OK]

Common Mistakes:

• Allowing any report causes many invalids
• Ignoring new participants is unfair
• Paying invalid reports wastes resources