[Journey] Zero to $1,000/mo+ from Bug Bounty

That’s my fear. I would have liked to start out in cybersecurity, but AI can already handle it autonomously and is getting better at it.

October was finally a decent month. 3 bounties, $1,500 total. 4 bugs submitted, 1 duplicate. Averaging about 1 bug per week. Writing reports takes a long time because I try to make them super accurate and detailed, including video PoC most of the time. That can seriously cost me when it comes to racing against other hunters all using AI to find the same vuln at the same time. Not sure what to do about that. I hate the idea of submitting an incomplete report just to get it in before another hunter. This usually only happens when a new scope is added on a program and everyone hits it at once.

These days I typically don't even submit mediums anymore as I'd rather focus on high impact. I might be leaving money on the table that way, but the mediums can still potentially be leveraged for chain exploits in the future.

Ezzra said:

Sorry for the late reply, I'm still hunting for bugs these days with the help of AI (Claude) reading documents for me.

I don't have tech background, so I only focus on less technical bug types like BAC, logic, race conditions, information disclosure and API hacking (REST and GraphQL).

Most of the time, I hunt on H1 (both private and public programs) and Intigriti, but the triage time is horrible because of those "AI slop hunters". Platforms have to hire new bunch of triagers, so the triage experience is bad too.

Still making money consistently, but now it took a long time for the bounty come to your account.

What about you?

Click to expand...

Good to hear you're still making money bro, keep at it. "BAC, logic, race conditions" those are the most satisfying bugs to hunt manually and don't require huge amounts of in-depth knowledge.

thomasbehe02154 said:

good luck with the journey mate thanks for sharing your progress and hope your next findings bring some solid bounties.

Click to expand...

Thank you mate, I appreciate it!

vafiyog said:

Very interesting, I also tried bounty programs myself for a while but without much success

Click to expand...

It's pretty difficult to break into and usually takes months of failing to start seeing any success. Keep trying if it's something you are interested in.

ryanmcarter said:

You mentioned going back to manual hunting to avoid duplicates. Have you noticed any difference in the number of accepted reports compared to using AI agents? It would be interesting to see which approach is giving you better results.

Click to expand...

To avoid duplicates I try to find private programs with low activity and then go super deep on those, mixing manual hunting with AI agents. Usually I know beforehand the likelihood of being duplicate based on recent submission activity on that program, unless it's a bug that went unpatched for a long time.

I have been considering dipping my into bug bounties as a side hustle. Just haven't had the time to sit down and start learning. Anyway, best of luck to you and I'll be watching the thread.

Thanks for the update

Bamspeedy said:

These days I typically don't even submit mediums anymore as I'd rather focus on high impact. I might be leaving money on the table that way, but the mediums can still potentially be leveraged for chain exploits in the future.

Click to expand...

Can I ask why you don't submit medium bugs?
I mean sure, high impact = more $$$, but it requires a lot of time to research. Sometimes it's not worth the ROI because many private programs only pay $1k for high and $3k for crits.
If you want to hit that big $, you have to compete in public programs that pay 10-20k$ for crits.

To avoid duplicates I try to find private programs with low activity

Click to expand...

Btw, don't shy away from big programs, I started hunting on GitLab, Google, and Snapchat this year and already found some bugs.