-c.png)
Bug bounty programs come with their own set of jargon and terminology that are commonly used within the cybersecurity community. Here are some jargons specific to bug bounty programs:
Bounty: The reward offered to ethical hackers for discovering and responsibly disclosing vulnerabilities.
Vulnerability: A flaw or weakness in a system that could potentially be exploited by attackers.
CVE (Common Vulnerabilities and Exposures): A standardized identifier for vulnerabilities, allowing for easy tracking and sharing of security-related information.
Payout Tiers: Different levels of rewards based on the severity of the vulnerability. Often categorized as critical, high, medium, and low.
Proof of Concept (PoC): A demonstration that shows how a vulnerability could be exploited without causing harm.
Disclosure Policy: A set of guidelines and rules outlining how vulnerabilities should be reported and disclosed.
Scope: The specific systems, applications, or components that are eligible for testing within a bug bounty program.
In-Scope: Systems or assets that are within the defined scope of the bug bounty program.
Out-of-Scope: Systems or assets that are explicitly excluded from the bug bounty program.
False Positive: A reported vulnerability that is found not to be a genuine security issue upon investigation.
White Hat Hacker: An ethical hacker who uses their skills to identify vulnerabilities and help improve security.
Black Hat Hacker: A malicious hacker who exploits vulnerabilities for personal gain or harm.
Grey Hat Hacker: An individual who falls between white hat and black hat hackers, often disclosing vulnerabilities without explicit permission.
Bug Bounty Platform: An online platform that connects ethical hackers with organizations offering bug bounty programs.
Responsible Disclosure: The practice of notifying an organization about a vulnerability without exploiting it maliciously, allowing them to fix it before disclosure.
Zero-Day Vulnerability: A vulnerability that is exploited by attackers before the organization becomes aware of it, leaving zero days for mitigation.
CVSS (Common Vulnerability Scoring System): A system used to assess and rate the severity of vulnerabilities.
Escalation Path: A predefined process for escalating critical vulnerabilities to higher levels of management within an organization.
Hall of Fame: A section on the bug bounty platform that publicly recognizes and credits ethical hackers for their contributions.
Disclosure Agreement: A legal agreement outlining the terms and conditions under which vulnerabilities can be reported and disclosed.
Bug Report: A detailed document submitted by an ethical hacker, describing the discovered vulnerability, its impact, and possible mitigation.
Attack Surface: The set of points in a system that are vulnerable to potential attacks.
Remediation: The process of addressing and fixing a reported vulnerability to eliminate the risk it poses.
Rewards Program: The structure and details of how ethical hackers are rewarded for their findings, including payout amounts and criteria.
These terms are commonly used within the bug bounty ecosystem and understanding them can help both organizations and ethical hackers navigate the bug bounty program effectively.