Every week, I get DMs from students who've just discovered bug bounty and want to know how to get started. Most of these conversations follow the same pattern — so here's the compact version, in one place.
The reality check first
Your first year in bug bounty will probably not make you rich. It will probably not even pay for your electricity bill some months. That's normal. That's the deal.
What it will do — if you approach it right — is give you the portfolio, the skills, and the industry connections to land a real security job. That's the actual reward. The bounties are a bonus.
Set that expectation now and you'll survive the year. Chase money in year one and you'll quit in month three.
Skip the recon-tool obsession
New hunters download every recon tool that trended on Twitter last week. Subfinder, amass, nuclei, gau, waybackurls, ffuf, arjun, kiterunner, sqlmap, xsstrike — and then use none of them well.
One tool, learned deeply, beats twelve tools, half-understood.
For your first six months, master Burp Suite. That's it. When you can drive Burp with keyboard shortcuts, write your own extensions in Python or Kotlin, and know what every setting on the intercept tab does — then look at what else you actually need.
Nuclei and ffuf get bolted on later when you have the fundamentals to write custom templates and wordlists.
Read reports, don't just watch videos
YouTube walkthroughs are great for pattern recognition. But at some point you have to stop consuming and start applying.
The single highest-leverage habit in year one is reading three HackerOne public reports every morning. Not skimming — actually reading. Then trying to reconstruct the researcher's thinking. Why did they test this endpoint first? What made them look at this specific parameter? What signal in the response tipped them off?
Do this for six months and your intuition compounds in a way that no tutorial can match.
Pick your first program carefully
Every beginner wants to hunt on Uber, Shopify, and PayPal. Every advanced hunter is already hunting on Uber, Shopify, and PayPal.
Your first three months should be spent on scoped programs that are:
- Wide — big attack surface, many subdomains
- Not too popular — measurable low-hanging fruit still exists
- Government or NGO tier — often forgiving, patient triagers
Even VDP-only programs (no bounty) are gold in year one. Every valid finding is a portfolio piece. Every writeup is résumé material. Money comes later.
Write everything down
Every finding. Every dead-end. Every clever payload someone else used that you didn't understand yet. Every SSL cert misconfiguration that turned out to be nothing.
You are building a personal knowledge base that will be more valuable than any bounty in year one. When you land your first interview in year two, you will refer back to this notebook constantly.
Use whatever tool you like. Obsidian is popular. So is a plain markdown folder in a private GitHub repo. Doesn't matter. What matters is that you write it down.
Report writing is the actual skill
Finding a bug is 30% of the work. Writing a report a triager will accept without back-and-forth is the other 70%.
Every VDR should have:
- One-line summary that a busy engineer can read in five seconds
- Steps to reproduce with exact URLs, exact payloads, no ambiguity
- Impact — what a malicious actor can do with this
- Suggested fix — you don't have to be right, but propose something
If you nail this format, triagers start recognizing your reports and processing them faster. This compounds. By month six you have a reputation. By month twelve, invite-only programs start rolling in.
What year two looks like
If you did year one right — 20-50 valid submissions, clean report style, growing personal wiki, one solid specialty (web / API / mobile) — year two starts paying.
Not paying enormously. But enough that you can quit thinking of it as a lottery ticket and start thinking of it as a real skill.
That's when this becomes fun. And that's the goal.
— Jagdeep