Find and responsibly disclose security vulnerabilities for cash rewards on HackerOne/Bugcrowd.
Why that grade Payout distribution and elite-hunter figures are widely cited platform and community statistics; median individual payouts specifically are drawn from general community consensus rather than one audited source. Course-seller index 3/10.
Figures are researched estimates, not guarantees. Check local rules before you trade.
Companies would rather pay a hacker to find and responsibly report a flaw than have it exploited or discovered by a regulator, so they fund ongoing bounty programs — real, well-paid work for genuinely skilled security researchers.
Extremely top-heavy distribution: median individual payouts are small (many hunters earn $0-$500/year total); mid-tier skilled hunters can make $20,000-$80,000/year; a small elite (top ~100 hackers) earn six figures, with several individuals crossing $1M+ lifetime and critical/RCE bugs at some programs paying $10,000-$50,000+ per report.
Someone with genuine, developed technical skill in web/app security, willing to spend months building that skill before landing a first valid paid report.
Anyone treating this as a beginner-accessible side hustle — it is not, and the field is now flooded with AI-assisted low-quality report spam that has eroded triage patience for everyone, beginners included.
Testing anything outside a program's declared scope can constitute unauthorized computer access — a real crime, not just a rules violation — so the legal safety of this work depends entirely on your own discipline about staying inside bounds, not the platform's.
5 steps to your first paying customer
OWASP Top 10 and hands-on practice with Burp Suite are the standard starting point.
Done when You've worked through the OWASP Top 10 hands-on in Burp Suite and can independently find at least one vulnerability class (e.g. XSS, IDOR) in a deliberately vulnerable practice app.
HackerOne, Bugcrowd and Intigriti all list public programs — pick ones with broad, clearly defined scope to start.
Done when You're actively testing on at least two public HackerOne, Bugcrowd or Intigriti programs with broad, clearly defined scope.
The rest of the playbook: what to charge, what you need in place before you take money, where the first customers come from, and what each step costs.
Free forever · no card · 30 secondsN/A — individual skilled gig work.
Deep specialization in one vulnerability class or tech stack
A strong reputation score that unlocks invite-only, higher-paying private programs
A strong track record can lead to full-time security research roles or independent pentest consulting.
Get paid to stress-test AI models for harmful outputs, security flaws and bias for labs and enterprises.
Use real professional credentials to train and evaluate AI models via Mercor or Handshake AI.
Get paid to break AI models — extract harmful outputs, bypass safety filters, find factual or security flaws.