The Struggle of Bug Bounties | Finding Bugs vs. Getting Paid

A growing coalition of people in the bug bounty community is voicing anger over plummeting payouts, as reports highlight a disturbing drop in compensation for hunters. Despite an uptick in submissions, actual earnings remain dishearteningly low, triggering widespread industry concern.

The Dismal Statistics

Reports reveal a troubling trend among bounty hunters.* An analysis across several platforms highlights a concerning lack of responsiveness to submitted reports, with many meeting inadequate reactions or outright dismissals.*

• 42 reports logged in July, chiefly from popular companies.

• 18 received no response whatsoever.

• 7 were deemed out-of-scope for dubious reasons.

• Earnings from these submissions totalled over $100,000, yet only $1,700 was paid out.

"This sets a dangerous precedent," remarked a community member who experienced multiple significant vulnerabilities without getting paid.

Frustration echoes through the community, as one participant lamented, "I was fighting for highs with zero success." Many claim findings were closed without valid justification.

The Growing Frustration

As compensation plateaus, more hunters are reconsidering their roles. A user pointed out, "At this point, I might just stop reporting to all but a few good programs. It's a waste of my time to document my work only to get nothing back."

Another commentator relayed their experience: "I logged multiple reports with Intigriti, but two were closed as N/A because the triage staff just didn’t read them properly. They’ve sat closed for two months!"

Critics argue that with long triage times and inadequate pay, remaining in the field may not be sustainable. "Long waiting periods for triage make it unappealing," one user stated.

Community Response

Interestingly, some platforms are recognizing these growing frustrations. A representative announced,

"We’ve doubled our triage capacity and are working on improvements across operations." They encourage contributions from those experiencing pay issues, promising changes are on the horizon.

Nevertheless, as more people share frustrations online, a crucial question arises: can these platforms adapt to meet the community's needs?

Key Insights

• ★ 42 total reports logged with 18 receiving no response.

• ▼ Average payout now sits at a mere $1,700, down from over $100,000.

• **✪ "I spent 21 days waiting for a response that was 'not applicable.'" - A recurring sentiment.

• ✓ "Despite issues, I still think HackerOne may be the best option," reflected numerous comments.

As dissatisfaction soars, pressure mounts on the industry to reassess compensation models or risk losing experienced talent.

Shifting Tides in the Bounty Landscape

As dilemmas expand within the bug bounty space, patience appears to be running thin. Some estimates suggest that as many as 60% of bounty hunters could reconsider their involvement if financial discontent continues. This hesitance may compel companies to enhance their payout structures.

Interestingly, one can’t help but notice parallels between today’s industry and past struggles in online content monetization, reminiscent of early internet creators grappling with advertising payout disparities. Much like those creators found new revenue opportunities, bug hunters may start looking toward alternative pathways to showcase their expertise or seek platforms offering better rewards. How will the industry adapt?

End

The current battle of bug bounties emphasizes the crucial interplay between rewarding skilled testers and maintaining program integrity. With many individuals feeling overworked and misunderstood, the bug bounty platform landscape must evolve. The stakes are high as companies strive to keep experienced bug hunters in their ranks.