Pain Points¶

Pain Point Catalog¶

The following pain points are drawn from public post-mortems, researcher community discussions on forums such as Hacker101 and Bugcrowd's Discord, and published retrospectives by HackerOne and independent researchers. They represent recurring, structural problems rather than one-off incidents.

Low ROI on Time Investment¶

The economics of bug bounties follow a power-law distribution. A small number of elite researchers -- often those who have built proprietary tooling, deep target knowledge, or exclusive access to private programs -- capture a disproportionate share of total payouts. The majority of participants earn modest amounts across many submissions.

The workflow for a single valid submission typically spans:

1. Recon: Asset enumeration, subdomain discovery, endpoint mapping (2-8 hours depending on target size)
2. Testing: Identifying and reproducing the vulnerability (variable, often the largest time block)
3. Report writing: Clear reproduction steps, impact assessment, suggested remediation (1-3 hours for a quality report)
4. Back-and-forth: Responding to triage questions, re-testing patches, disputing severity (1-10 hours, often unpredictable)

This creates what researchers informally call the "lottery ticket" dynamic: the payout distribution is skewed enough that participation resembles speculative investment more than predictable labor. Many researchers explicitly frame bug bounties as learning opportunities or resume-building exercises rather than primary income, which masks the extent to which the compensation model is unsustainable for professional-grade effort.

Duplicate Reports¶

The structural problem is the absence of cross-platform deduplication. A vulnerability in a target's infrastructure may be discoverable from multiple angles, and two researchers working independently will sometimes arrive at the same finding through different paths. Within a single platform, deduplication is handled by triage staff, but there is no mechanism that prevents the same researcher from duplicating effort against the same target across HackerOne, Bugcrowd, and a company's self-managed program simultaneously.

Even within a single platform, the timeline for a duplicate determination can extend for weeks. A researcher may have moved on, submitted follow-up reports, or published analysis before learning the original was marked duplicate. The gap between submission and determination is uncompensated time.

Slow Vendor Response¶

The coordinated disclosure model assumes that researchers will hold a vulnerability private for a defined window (typically 90 days, following Google Project Zero's standard) while the vendor develops and ships a patch. When vendors fail to triage in a timely manner, that window shrinks on the back end. A vendor that takes 60 days to acknowledge a report has consumed two-thirds of the disclosure window before patch work begins, leaving minimal time for testing and deployment.

Platform SLAs (service-level agreements) are inconsistently enforced. Some platforms publish response-time targets but have no mechanism to penalize programs that miss them. Researchers who escalate delayed reports risk being flagged as difficult to work with, creating a chilling effect on legitimate follow-up. The power asymmetry -- vendors can close programs or reduce bounties; researchers have no equivalent leverage -- means that slow response is a rational strategy for a vendor that is resource-constrained or simply deprioritizing security work.

Inconsistent Policies¶

The "informative" closure is a particular irritant. Programs can close a report as "informative" to acknowledge receipt without committing to remediation or payment. This category is supposed to cover findings that are technically valid but not actionable, but it is frequently used for valid vulnerabilities that the vendor has decided not to fix. The researcher receives no payout and no explanation strong enough to contest.

There is no standardized severity assessment methodology enforced across programs. While CVSS is widely cited, vendors routinely override it based on internal business logic, contextual factors, or simple disagreement. A vulnerability rated Critical by a researcher may be rated Medium by a vendor, with the difference determining whether the payout is $500 or $10,000. The criteria for these overrides are rarely published in program policies.

Legal Risks¶

Safe harbor provisions in bug bounty program policies vary enormously in quality. Some programs offer robust, attorney-reviewed safe harbors that provide meaningful legal protection. Others include language that is aspirational rather than binding, or that carves out exceptions broad enough to expose researchers to liability for standard testing techniques.

The DOJ's 2022 policy update on CFAA enforcement represented meaningful progress, directing prosecutors to avoid charging good-faith security research as a CFAA violation. However, the policy applies only to federal prosecution, does not constrain civil liability, and does not bind state prosecutors or foreign jurisdictions. Researchers working across international targets face a patchwork of legal exposure that cannot be fully addressed by any single program's safe harbor.

The practical effect is a chilling influence on research at the margins: automated scanning at scale, testing against production systems, and research into sensitive target categories (healthcare, critical infrastructure, financial systems) all carry elevated legal risk that many researchers rationally choose to avoid.

See Government Programs for analysis of how government-led vulnerability disclosure frameworks are attempting to address this through coordinated legal reform.

Rejected Valid Reports¶

Severity disagreements are common and consequential. CVSS scores are inputs to payout calculations on most platforms, and a single severity tier can represent a substantial payout difference. When researchers and vendors disagree on severity, the vendor's assessment prevails. Some platforms offer mediation processes, but these are informal and platform-discretionary, not contractual rights.

The absence of a standardized appeal mechanism is both a fairness problem and a market efficiency problem. Researchers who feel burned by a rejection are less likely to submit to that program in the future, which reduces the volume of research the vendor receives. Programs with reputations for unfair closures struggle to attract top-tier researchers, creating a selection effect that disadvantages both parties.

Disclosure-as-leverage -- publishing a vulnerability after the disclosure window closes -- is the primary recourse available to researchers facing non-responsive or bad-faith vendors. This is legally and reputationally costly for researchers, which means it is used rarely and only in clear-cut cases. Vendors who engage in borderline behavior rarely face accountability.

Systemic Effects¶

Individually, each pain point reduces participation quality or volume in specific programs. Collectively, they reshape the ecosystem in ways that affect every participant:

Gray and black market participation. Researchers who repeatedly encounter low ROI, rejected reports, or legal exposure will rationally explore alternative markets. The vulnerability broker market offers substantially higher payouts for specific vulnerability classes, with no requirement for coordinated disclosure and no ambiguity about payout. Each researcher who makes this transition represents a permanent loss to the defensive ecosystem, as their findings will not result in vendor patches.

Unreported vulnerabilities. Negative experiences are a major driver of non-disclosure. A researcher who spends 20 hours on a finding, receives a "duplicate" determination with no payout, and then watches the same vulnerability disclosed by another researcher six months later is unlikely to repeat the investment. The vulnerability pipeline depends on sustained researcher engagement, and friction is the primary mechanism by which that engagement erodes.

Intelligence loss. The ecosystem's value to the security community extends beyond individual patches. Aggregate data on what vulnerability classes are being found, in which technology stacks, at what rates, provides signal for tool builders, defenders, and policymakers. When researchers disengage, that intelligence disappears. Platforms capture some of it, but the fraction that flows to the broader community through public disclosures, conference talks, and research papers depends on researchers who feel it is worth the effort to share.

The net effect is an ecosystem that is less efficient than it could be at its stated goal: finding and fixing vulnerabilities before attackers exploit them. See Government Programs for analysis of regulatory efforts that attempt to address these structural problems through mandatory disclosure frameworks, legal reform, and public sector program development.

tags: - glossary

Glossary¶