Also known as: vulnerability reward program · VRP
A bug bounty is a programme in which an organisation offers monetary rewards to external security researchers who responsibly report vulnerabilities in its systems.
Bug bounties provide continuous, incentive-aligned testing from a far larger and more diverse pool of researchers than any internal team, with payment contingent on results rather than time.
They complement rather than replace structured assessment. Bounty hunters naturally gravitate toward findings that pay well and are quick to demonstrate, so coverage can be uneven — deep architectural review and threat modelling still require dedicated effort.
Responsible Disclosure
Responsible disclosure, also called coordinated vulnerability disclosure, is the practice of privately reporting a vulnerability to the affected vendor and allowing a defined period for a fix before publishing details.
Penetration Testing
Penetration testing is an authorised, time-boxed assessment in which security professionals attempt to exploit vulnerabilities in a defined target to demonstrate real-world impact and provide remediation guidance.
Vulnerability Management
Vulnerability management is the ongoing process of identifying, prioritising, remediating, and verifying fixes for security weaknesses across an organisation's systems and software.
CVE
CVE (Common Vulnerabilities and Exposures) is a public catalogue that assigns a unique identifier, such as CVE-2026-31337, to each publicly disclosed software vulnerability so that everyone can refer to the same flaw unambiguously.