Registration
Company, contact person and domain. A person reviews the request within 2 working days.
home / services / bug bounty
service · private bug bounty
Private bug bounty: you pay only for validated evidence.
A private programme with verified researchers, a signed scope and a reviewer who validates every report. The reward depends on the proof, not on the number of reports.
how it starts
Four steps, with a control at each one.
Domain verification
A DNS record proves control of the domain. Without the record, the programme does not start.
Signed scope
In-scope hosts, out-of-scope hosts and rules of engagement. Every change is a new signed version.
Written rewards
Rewards by severity, defined before launch, with a monthly cap agreed in advance.
how it pays
The reward follows the proof, not the volume.
| Severity | CVSS v4.0 score | When it is paid |
|---|---|---|
| Critical | 9.0 – 10.0 | On validation of the report |
| High | 7.0 – 8.9 | On validation of the report |
| Medium | 4.0 – 6.9 | On validation of the report |
| Low | 0.1 – 3.9 | On validation of the report |
| Informational | 0.0 | No reward: useful report, without direct impact |
rules that protect both sides
No incentive to inflate severity.
One payment only
Each validated vulnerability is rewarded once. Duplicates are not rewarded.
Out of scope, no reward
A report on a host outside the scope is closed, and the client is told.
Human reviewer
Every report is reproduced by a person before it is accepted.
what the client gets
More control, no surprises.
Included
- Scope and rules written before launch
- Every report with reproduction steps
- A reasoned verdict and verification of fixes
- A monthly spending cap agreed in advance
Not included
- Testing without a signed scope
- Payment for duplicate or out-of-scope reports
- Publication of results without authorisation
why choose this programme
Less noise, controlled spending, evidence that stands up in front of an auditor.
Every report is reproduced
A person reproduces the vulnerability before it is accepted: your team reads only demonstrated reports.
Predictable spending
Rewards by severity written before the start and an agreed monthly cap. No surprises at the end of the month.
Evidence for GDPR and NIS2
The log of reports and fixes documents how you handle vulnerabilities, as GDPR Article 32 and NIS2 Article 21 ask.
rules of engagement
What is allowed, and how to report.
Written, signed rules
The scope, the permitted methods and the prohibitions (denial of service, social engineering, access to real data beyond what is needed) are put in writing before the start.
A single reporting channel
Researchers report through one channel, with reproduction steps. Every change to the rules is a new signed version.
a lighter first step
Managed coordinated vulnerability disclosure programme (VDP).
For those not ready to pay rewards yet
You publish a channel to receive reports and we do the triage: reproduction, severity and a reply to the reporter. On quotation.
It can grow into a bug bounty
If the flow of reports justifies it, verified researchers and rewards are added, under the same rules.
why it matters
The problem is not finding vulnerabilities: it is verifying them.
In 2026 several open bug bounty programmes suspended or reduced payouts because they were flooded with unverified automated reports. According to trade press, curl ended its bounty on HackerOne, Bugcrowd recorded more than four times the usual submissions in three weeks, Intel suspended cash rewards and Google paused its open source programme from 1 October.
A private programme solves the problem at the root: verified researchers, a signed scope and a person who reproduces every report before accepting it. The company pays only for what is proven, and does not waste time reading noise.
Sources: Malwarebytes, BleepingComputer, TechTarget.
questions
Frequently asked questions about the private bug bounty.
What happens if no researcher finds anything?
You pay the agreed fee, but no rewards: rewards are triggered only by validated reports.
Can I cap the spending?
Yes. A monthly spending cap is agreed before the start and written into the proposal.
How are duplicate reports handled?
Each validated vulnerability is rewarded once: duplicates are not rewarded.
Who can test my systems?
Only the verified researchers admitted to the programme, and only on the hosts listed in the signed scope. Every other host is out of scope.
Do you want to launch a private programme on your scope?
We reply by hand with a written proposal: fee, rewards and scope.