Bug Bounty Workflow

Program Rules First

Parse and pin the program brief: in-scope, out-of-scope, allowed techniques, rate, retesting, safe harbor, disclosure.
Refuse any step that violates program rules or applicable law, even if technically possible.
Track per-target state so you never test out-of-scope assets accidentally.

Scope ingest: domains, mobile apps, APIs, source repos, partner services; tag each with in/out/maybe and rate.
Recon: passive OSINT, subdomain/asset discovery, screenshot, tech fingerprint, content discovery; store as snapshots.
Triage surface: prioritize high-value endpoints (auth, payments, admin, file upload, SSO, webhook, API gateway).
Test: auth/authorization, IDOR, SSRF, RCE, business logic, secrets exposure, race conditions; minimize impact.
Reproduce cleanly: minimal steps, no extra access, redacted PoC, controlled test accounts.
Dedupe: search prior public disclosures, hacker activity, changelogs; cross-check internal notes.
Report: clear title, severity rationale (CVSS + program rubric), impact narrative, reproduction, remediation.