Managing your bug bounty program on Bugbop
Go to "My Programs" and click "Create New Program". You will need to provide:
All new programs start as Private. You can change visibility after upgrading to a paid plan.
Not listed anywhere on Bugbop. Only users you explicitly invite can see the program or submit Bug Reports. This is the default for all new programs.
Listed on the Public Programs page and open to all Bug Hunters. Any authenticated user can join and submit Bug Reports without approval.
Listed on the Public Programs page, but Bug Hunters must request access and be approved before submitting Bug Reports. This is useful for non-public systems where you need to provision user accounts, set up test environments, or provide credentials before a researcher can begin testing. You can configure a custom access request template and acceptance message to guide researchers through onboarding.
Only visible to already-enrolled users. No new Bug Reports can be submitted. Useful for temporarily pausing intake while you work through a backlog or restructure your program.
From your program page, go to the "Users" tab and click "Invite User". Enter their email address and select a role. They will receive an email invitation to join.
For private or restricted programs, go to the "Bug Hunters" tab and click "Invite Bug Hunter". Enter their email address or Bugbop username.
For restricted programs, pending access requests appear in the "Bug Hunters" tab. You can review each request and approve or reject it from there.
Bounty ranges are configured in the program edit form under "Bounty Range Settings". Set a minimum and maximum for each severity level (Critical, High, Medium, Low).
To award a bounty, open the report and click "Edit". Set the bounty amount and save. The Bug Hunter will be notified of the award.
Bugbop automatically pauses bounties when your budget is exhausted and resumes them when budget becomes available (e.g., after a budget period reset or when reports are closed).
The bounty amounts you offer directly impact the level of testing interest your program receives.
It is common to start with lower bounties and increase them over time as your application becomes more secure and bugs become harder to find. Higher bounties attract more experienced researchers.
Consider setting the minimum for Low severity to $0 (thanks only). This avoids paying out for low-impact or informational findings that may not warrant a cash reward, while still acknowledging the researcher's effort.
| Severity | Range |
|---|---|
| Critical | $100 - $500 |
| High | $50 - $350 |
| Medium | $25 - $200 |
| Low | $0 - $50 |
Mostly beginners and hobbyists. Be aware that at this level, even a small bounty is enough incentive for researchers to run automated scanning tools against your assets and submit whatever they find.
| Severity | Range |
|---|---|
| Critical | $500 - $2,000 |
| High | $350 - $1,400 |
| Medium | $200 - $800 |
| Low | $0 - $200 |
A mix of hobbyists and part-time bug hunters willing to do manual testing. Good for growing startups and medium-risk applications.
| Severity | Range |
|---|---|
| Critical | $2,000 - $10,000+ |
| High | $1,400 - $5,000 |
| Medium | $800 - $2,000 |
| Low | $0 - $500 |
Attracts professional bug hunters and security researchers capable of finding complex vulnerabilities.
Our security experts can guide you through setting up and managing an effective bug bounty program tailored to your organization's needs.