What is Bug Bounty scope management and how to submit high-quality vulnerability reports?

Bug bounty scope management defines the exact assets, endpoints, and testing boundaries a researcher may engage with, while high‑quality reports deliver reproducible proof, impact metrics, and remediation guidance. 1. **Collect the program definition** – download the scope PDF or read the HackerOne/Intigriti JSON policy; note `in_scope` URLs, `out_of_scope` patterns, and any `rate_limit` or `auth` flags. 2. **Map the attack surface** – run `nmap -sV -p 80,443,8443 --script http-enum ` and feed results into `assetfinder -subs-only example.com | sort -u > assets.txt`. 3. **Validate scope boundaries** – cross‑reference each discovered host with the table below; any mismatch must be cleared via the program’s “Ask a Question” channel before testing. 4. **Prioritize findings** – apply the CVSS‑v3.1 formula, but cap the base score at 9.0 for web‑app bugs unless the program explicitly allows full CVSS. Use `cvsscalc -s 3.1 -a N -c H -i L -a N -e H` to generate the vector. 5. **Exploit reproducibly** – script the PoC with `curl -X POST -d @payload.json https://api.example.com/v1/login -H "Content-Type: application/json"` and capture the full request/response logs. 6. **Document the report** – follow the template (see code block) that includes **Summary**, **Steps to Reproduce**, **Impact**, **Remediation**, and **References**. 7. **Submit and track** – upload the markdown file via the platform UI, set the severity manually if the auto‑calc differs, and monitor the triage comments. | Category | In‑scope | Out‑of‑scope | |----------|----------|--------------| | Subdomains | *.example.com | *.dev.example.com | | APIs | GET/POST /v1/* | Internal admin API | | Cloud | Public S3 buckets | Private VPC | ```markdown ## Vulnerability Report Template **Title:** [VULN] Reflected XSS in `/search` **Severity:** High (CVSS 8.6) **Summary:** User‑controlled query parameter `q` is reflected without encoding. **Steps to Reproduce:** 1. `curl "https://example.com/search?q=%3Cscript%3Ealert(1)%3C/script%3E"` 2. Observe alert execution in the browser. **Impact:** Arbitrary JavaScript execution in victim browsers, enabling session hijacking. **Remediation:** Encode output using `htmlspecialchars` or a CSP with `script-src 'self'`. **References:** OWASP XSS Cheat Sheet, CVE‑2025‑12345. ``` **Gotcha:** Do not assume a disclosed CVE automatically qualifies; many programs require a custom impact rating based on the target’s environment, so adjust the severity accordingly.