Target selection & prioritisation

When it applies

You have more scope than time. Whether picking a bug-bounty program or ordering assets inside one authorized engagement, the choice of where to look usually matters more than how hard you look.

Why it works

Vulnerabilities cluster where code is new, complex, or neglected, and payout/impact clusters where the asset is important. Spending your first hours choosing well beats grinding a hardened, picked-over target — most reports come from a minority of assets.