A researcher hunches over a terminal at 2 a.m., caffeine and adrenaline singing in their veins. They just found it: a logic flaw in a major financial app that lets them see other users’ transaction histories. This is the big one. The kind of thing that builds a career. They navigate to the company’s security page, ready to report it, and the feeling evaporates. It’s replaced by a cold knot in the stomach.
The bug bounty policy is a fortress of legalese. The vulnerability they found falls into an “out of scope” category. Public disclosure is grounds for immediate legal action. Reporting it through the proper channels will likely earn them a polite "thank you" and a non-disclosure agreement that functions as a gag order. The choice is no longer between a reward and nothing; it’s between silence and a lawsuit.
It wasn’t supposed to be this way. Bug bounty programs were meant to be a détente in the forever war between builders and breakers. Companies offered a cash reward and a safe harbor, and in return, the security community would help them find and fix flaws before criminals could exploit them. It was a simple, elegant transaction that made everyone safer.
That transaction is now an extortion. Corporate legal departments have taken over. The scope of many programs has been gerrymandered to exclude the most impactful and embarrassing vulnerabilities. Authentication bypasses? Out of scope. Server-side request forgery? Out of scope. Anything involving a third-party integration that the company relies on? Definitely out of scope. The message is clear: You are permitted to find only the bugs we are comfortable fixing.
This transforms the bounty from a reward for good work into a compliance payment. It’s hush money. The payout, often a pittance compared to the value of the exploit on the black market, is contingent on absolute silence. The researcher effectively signs away their right to talk about their work, to publish their findings, or to warn the public if the company decides to drag its feet on a fix. It’s a protection racket with a web form. Follow our rules and report the flaws we designate, and we won’t send the lawyers after you. Find something truly dangerous, something that questions our core architecture, and you’re on your own.
The stakes here are not about a researcher’s bruised ego or a missed payday. This chilling effect pushes talent away from defensive work. It encourages a culture of security theater, where companies can boast about their "robust" bounty program while carefully curating the types of vulnerabilities that ever see the light of day. The most critical flaws—the systemic ones—are the ones researchers are now most terrified to find. The watchdogs are being told which houses they’re allowed to bark at, ensuring the real intruders can slip by in the dark.
Generated by Reportify AI — Automate your team's status reports, standups, and weekly updates. Try free →