Bug bounty programmes and responsible disclosure
You learn the rules of bug bounty programmes and disclosure policies, the legal differences between countries and the ethical limits, work methodically on a fictional programme and write a submission, and set up the disclosure process on the organisation’s side.
Level 301 · 15 lessons · 13 practice labs
Lessons
Rules and ethics
- Bug bounty programmes and vulnerability disclosure policies (VDP)
- Scope, rules and safe-harbour clauses: test only what is allowed
- The legal frame: differences between countries and unauthorised-access laws
- Ethical limits: data access, service disruption and the ban on social engineering
- Short task: read a sample programme policy and separate allowed from forbidden tests
Methodology
- Methodology: understanding scope, learning the app and forming hypotheses
- Notes and target tracking: staying organised so you never repeat work
- Duplicate reports and showing impact correctly
- Writing a submission that fits the programme
- Short task: prepare a submission for the fictional programme in the lab
The organisation’s side
- Setting up security.txt and a disclosure channel
- The coordinated disclosure process: triage, fix and publication timeline
- Triaging incoming reports and communicating with researchers
- Obtaining a CVE and writing a security advisory
- Capstone: set up a disclosure policy and triage process for a fictional company
Practice labs
- In scope or out of scope: Classify ten test ideas as allowed, forbidden or ask-first under a fictional programme policy.
- Read the safe harbour clause: Compare the safe harbour clauses of two fictional policies and justify which protects the researcher better.
- Where to stop once you reach data: When you find an IDOR in the lab's fictional programme, decide the minimum access needed for proof and explain your stopping point in the report.
- Legal differences between countries: Assess the same test scenario under three countries' unauthorised access laws and write what the programme's authorisation changes.
- Write a report that fits the programme: Report a flaw you found in the lab's fictional programme with title, steps, impact and advice following the programme template.
- Note keeping: do not do the same work twice: Set up notes for a target that track tested endpoints, ideas tried and open questions.
- Show the impact accurately: Prove the real business impact of a finding that looks low-impact safely in the lab and describe it without exaggeration.
- Duplicate or new finding: Examine three reports that seem to share a root cause with a known finding and justify which are separate findings.
- Rewrite a rejected report: Rewrite a report rejected for lack of evidence with reproducible steps and clear impact.
- Publish a security.txt: Prepare a security.txt for the lab site with contact, policy and expiry fields and publish it at the right path.
- Triage incoming reports: Triage six reports in the lab disclosure inbox by validity and severity and write a short reply to each researcher.
- A coordinated disclosure timeline: Prepare a timeline with triage, fix and publication dates for a critical report and write the communication plan with the researcher.
- Write a security advisory: Write the security advisory for a fixed flaw with affected versions, impact and upgrade steps.
About this course
You learn the rules of bug bounty programmes and disclosure policies, the legal differences between countries and the ethical limits, work methodically on a fictional programme and write a submission, and set up the disclosure process on the organisation’s side.
What you will learn
- Rules and ethics
- Methodology
- The organisation’s side
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.