Learn bug bounty vocabulary: scope, safe harbor, proof of concept, duplicate reports, reward triage, and platform-specific language for HackerOne and Bugcrowd.
0 / 10 completed
1 / 10
What is 'scope' in a bug bounty program?
Scope defines what you are allowed to test. In-scope typically includes: specific domains (e.g., *.example.com), APIs, mobile apps. Out-of-scope might include: third-party integrations, customer subdomains, production data. Testing out-of-scope targets can void safe harbor protections — always check the scope section of the program policy before testing.
2 / 10
What is 'safe harbor' in a bug bounty program policy?
Safe harbor is the legal guarantee: 'If you follow our responsible disclosure policy, we will not pursue criminal or civil action against you for your research.' Without safe harbor, security researchers face legal risk under laws like the CFAA (Computer Fraud and Abuse Act). Researchers should verify a program has explicit safe harbor language before testing — 'we appreciate responsible disclosure' is not safe harbor.
3 / 10
What does it mean when a bug bounty report is marked as a 'duplicate'?
Duplicate means: 'We already have this issue in our queue from another researcher.' The first valid report gets the bounty; subsequent reports of the same issue receive no reward. To reduce duplicate risk: check the program's Hall of Fame for recently credited researchers; if similar issues have been reported, note the differentiation in your report. Some programs pay reduced rewards for informational duplicates that add new context.
4 / 10
What is 'reward triage' in the context of a bug bounty program?
Triage is the first stage of report review: is this a valid vulnerability? Is it in scope? What is the severity? Triage state vocabulary: 'New' (submitted), 'Triaging' (under review), 'Triaged' (validated, severity assigned), 'Duplicate', 'Informative' (not a security issue), 'N/A' (not applicable/out of scope). After triage, the report moves to 'Resolved' once patched and the reward is awarded.
5 / 10
What phrase indicates a bounty award in bug bounty platform communication?
'You've been awarded $X for this finding' is the standard bounty payment notification. Note the distinction: a report can be 'resolved' (fixed) without a bounty if it was out-of-scope, informative, or a duplicate. Bounty award and fix are separate events — some programs award on triage; others award on fix. The award message typically includes the severity rating and the reward amount.
6 / 10
Code Review Comment: During a code review of the authentication service, Alex comments to Ben: 'This request isn't properly validating the input against the expected schema. We should be using a tool like waf to mitigate potential vulnerabilities related to injection attacks. It's crucial to consider if this falls within the scope of our bug bounty program.' What is Alex primarily referring to?
Alex is focusing on whether the issue – a missing schema validation – constitutes a vulnerability that could be rewarded under the bug bounty program. The core concept here is 'scope' - specifically, whether the reported issue aligns with the defined rules and rewards for the program. The use of waf highlights the proactive approach to preventing exploitation.
7 / 10
Slack Message: Sarah sends a message in the #bug-bounty channel: 'Just submitted a report for a potential XSS vulnerability in the user profile editing page. The impact is low – only allows modification of display name – but I've included detailed steps to reproduce it. I'm hoping for a decent reward given the clear, demonstrable impact.' What aspect of Sarah's message demonstrates understanding of bug bounty program principles?
Sarah's statement about 'potential impact' is key. Bug bounty programs often prioritize vulnerabilities with a demonstrable effect on data or functionality, even if the technical complexity seems low. Understanding reward criteria – which typically involves impact assessment – is essential for a successful bug report.
8 / 10
API Response: The bug bounty platform's API returns the following JSON response when a reporter requests status updates on their submitted report (report_id: 'R12345'):
{"status": "pending", "severity": "medium", "reward_amount": null, "last_updated": "2024-01-26T10:30:00Z"}. What does the 'null' value for 'reward_amount' likely indicate?
'Null' in this context signifies that the reward amount hasn't been determined yet. It's common for bounty programs to initially assign a 'pending' status while administrators assess the vulnerability and its potential value before assigning a specific reward. This is often part of 'reward triage'.
9 / 10
PR Description: A developer commits a change to the codebase after receiving feedback on a bug bounty report. The PR description reads: 'Fixed the SQL injection vulnerability identified in the previous report. Added parameterized queries and input sanitization to prevent future exploitation. The reward is now confirmed at $500 based on the severity of the vulnerability.' What process does this description exemplify?
This PR description clearly demonstrates 'reward triage' – the process where the program administrators review the vulnerability and its impact to determine an appropriate reward amount. The final confirmation of $500 highlights this completed step in the bounty workflow.
10 / 10
Standup Update: During a daily standup meeting, David says, 'I'm currently working on addressing the vulnerability reported in R67890. The team is validating the fix and we anticipate submitting a pull request with confidence that it meets the program's criteria for reward qualification.' What does David imply about the status of his work?
David's statement indicates that the team has implemented a fix and is now awaiting confirmation from the bug bounty program administrators regarding reward eligibility. This aligns with the typical process – validation of the fix before confirming reward qualification.
What will I learn from the "Bug Bounty Program Vocabulary" exercise?
Learn bug bounty vocabulary: scope, safe harbor, proof of concept, duplicate reports, reward triage, and platform-specific language for HackerOne and Bugcrowd.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall required.
How many questions are in this exercise?
This set contains 10 multiple-choice questions, each with a detailed explanation shown after you answer.
Do I need to create an account to track my progress?
No account is required. Your progress bar and score reset each time you reload the page, but you can retry the exercise as many times as you like.
Who is this Security Disclosure Language exercise for?
This exercise is built for IT professionals and non-native English speakers who need to read, write, and discuss security disclosure language topics confidently at work.
What happens if I answer a question incorrectly?
You will see the correct answer highlighted along with a detailed explanation of why it is correct -- so every wrong answer becomes a learning moment, not just a lost point.
Can I retry this exercise?
Yes -- click "Try again" on the results screen at any time to reset your score and go through all the questions again.
How long does this exercise take to complete?
Most learners finish all 10 questions in under 10 minutes, since each question is answered by clicking a single option.
Where can I find more Security Disclosure Language exercises?
See the full Security Disclosure Language exercises hub for more vocabulary drills on this topic.
Is this exercise mobile-friendly?
Yes -- the exercise works on any device with a modern browser, including phones and tablets, with no app download required.