What is a bug bounty program and is it right for an Indian SME?
Key takeaways
- Bounties are usually a percentage of a published range, typically starting at 5% for low severity and reaching Rs 2,50,000 for a critical finding, so the range must be published up front.
- A programme needs a written safe harbour and a defined scope, otherwise researchers have no legal basis to test under sections 43 and 66 of the IT Act, 2000, and no incentive to report to you.
- Typical critical finding bounties in Indian public bug bounty programmes sit in the Rs 25,000 to Rs 2,50,000 band, and a single critical finding can exceed the whole bounty budget.
- Triage, not the testing, is the bottleneck: a programme that does not reply to reports within 72 hours gets abandoned by researchers.
- The DPDP Act, 2023 applies to the personal data in scope, so the programme policy must state how researchers handle personal data they encounter.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
How does a bug bounty programme actually work?
Five moving parts. A scope document naming exactly which domains, APIs, mobile applications and infrastructure are in bounds, and everything else is out of bounds by default. A published severity matrix that maps each finding type to a monetary range, so a researcher knows what a valid critical report is worth and you know what you will pay. A safe harbour clause stating that testing within the published scope and the published rules will not be treated as an offence under the IT Act, 2000, which is the only practical protection a researcher has. A reporting channel, ideally a platform that handles disclosure and payment, and a private reporting path for findings that involve live customer data. And a triage process with a named owner and a response time, because a programme without one is a liability.
When does a bounty work for an Indian SME?
When three conditions hold. One: you have a stable, public-facing attack surface, usually an API, a mobile application or a customer portal, and you can name the endpoints. Two: you can triage continuously, because researchers judge programmes by response time and an unanswered report is the fastest way to lose the community you are trying to attract. Three: your worst realistic bug is worth less than or comparable to the bounty you will pay, so the economics do not invert. If a single flaw in your payment logic could cost you Rs 50,000 in one transaction and the maximum bounty is Rs 25,000, a bounty is a discount on your adversary. In that case, buy a penetration test at a fixed price instead, where you control the effort and the deliverable.
What are the costs people forget?
Four. Triage effort, which is real work: reading each report, reproducing it, deciding severity and closing it. Payment administration, including the tax treatment of a payment to an individual and, where the platform operates as an intermediary, its own fee. The reputational cost of a public disclosure you did not want, which is why the safe harbour, the scope and the disclosure policy matter as much as the money. And the very real risk that a critical finding in production is discovered by a stranger during business hours rather than by a tester you scheduled. The last one is the argument for running a bounty and a test together rather than choosing between them.
What about the law and the data privacy side?
Two things. First, the legal footing. Because the researcher is testing your systems, the authorisation is the safe harbour in your policy, and it must be explicit about the permitted techniques, the prohibited ones and the reporting channel, because without it the researcher is exposed under sections 43 and 66 of the IT Act, 2000. Second, the data privacy side. Under the DPDP Act, 2023, the personal data in your scope is your responsibility, and a programme needs a stated position on what a researcher must do when they encounter personal data: stop, do not download, do not retain, and report it immediately. Programs that say nothing about this attract exactly the reports you do not want.
| Dimension | Bug bounty programme | Penetration test |
|---|---|---|
| Cost shape | Pays only for valid findings, per severity band | Fixed price, typically Rs 45,000 - Rs 1,20,000 per application |
| Timing | Continuous, no scheduled window | Agreed 1-2 week testing window |
| Coverage | Opportunistic, depends on who looks | Guaranteed against the agreed scope |
| Triage load | Continuous, usually the bottleneck | One report review at the end |
| Risk if you ignore it | Public disclosure during business hours | Known findings remain open until the retest |
What are the frequently asked questions?
Get a straight answer on this
Send us your public domains and API endpoints and we will return a bounty scope, a severity-to-bounty matrix and a safe harbour clause you can publish.
Send us the details See pricing