Bug Bounty Program
A managed bug bounty program on datacoconut. You publish scope, rules and a severity-to-bounty table; researchers test continuously; and every report arrives structured, in a workflow that tracks it from intake to retest to payout. Add managed triage and our analysts validate, classify and de-duplicate each finding before it reaches your engineers.
Timeline
You can publish in an afternoon. Getting the scope and reward table right is the part worth taking a week over — we will review both with you before you go live.
You get
- A published program page with scope, rules and safe harbour
- Structured report intake with a full, auditable report timeline
- Optional managed triage — validation, classification and de-duplication
If any of these is your week, this is the service.
Your surface changes faster than an annual test
You ship weekly. A point-in-time test describes the application as it was on the day it was tested, and not the one you deployed since.
What we do
A continuous program that keeps pace with the release cycle, priced per valid finding rather than per engagement.
You want to pay for results, not for time
A fixed-fee engagement costs the same whether it finds a critical or nothing at all.
What we do
A severity-to-bounty table you publish and control — you pay for findings that are real, at a price you set in advance.
You already receive unsolicited reports and handle them badly
Findings arrive by email to whoever, with no triage, no SLA, no safe harbour and no consistent answer to the researcher.
What we do
A published disclosure policy and a structured intake, so a good-faith report has somewhere to go — start with a free VDP.
Your team cannot absorb the triage load
The reports that arrive are a mix of duplicates, informatives and the occasional real finding, and sorting them costs engineering time.
What we do
Managed triage: platform analysts validate, classify and de-duplicate first, and recommend a move your team applies in one click.
Every step, and what leaves our hands at the end of it.
- 01
Publish
Set scope, rules of engagement, eligibility and a severity-to-bounty table, then go live as a public, private or disclosure-only program.
→ A live program page
- 02
Receive
Structured reports arrive in your inbox — optionally pre-validated, classified and de-duplicated by our analysts first.
→ Triaged reports
- 03
Fix
Assign an owner, remediate, and track response and resolution against the SLA you published.
- 04
Retest
Request a retest from the report itself; the researcher confirms the fix and the thread records it.
→ Confirmed fix
- 05
Reward
Pay the bounty by severity. The award is tracked through approval to settlement, and the researcher's reputation updates.
→ Settled payout
Deliverables.
- A published program page with scope, rules and safe harbour
- Structured report intake with a full, auditable report timeline
- Optional managed triage — validation, classification and de-duplication
- Remediation tracking, SLA reporting and researcher retest
- Payout tracking from award through approval to settlement
- Exportable records of every decision, for audit and compliance
Before we can quote.
- 01The assets you want tested, and everything explicitly out of scope
- 02A severity-to-bounty table, or a budget for us to build one from
- 03Who receives reports, and the response times you can genuinely meet
- 04Whether the program is public, private or disclosure-only to start
- 05Whether you want managed triage from day one
Do not worry about having all of it. Send what you have and we will work out the rest on the scoping call.
Bug Bounty Program, answered.
How is this different from a pentest?
A pentest is a fixed window with a named team and a guaranteed report on a date. A program is continuous and pays per valid finding, with no guarantee of attention in any given month. They answer different questions, and most mature teams run both.
What does it cost if nobody finds anything?
The bounties, nothing. You pay the platform fee and the awards you choose to make. A VDP — a disclosure channel with recognition instead of money — is free.
Can we start privately?
Yes, and most teams should. A private program invites researchers by skill and reputation and is a real access control, not a label — you choose who can see the scope and file against it, and open up when you are ready.
We will drown in duplicate reports.
That is what managed triage is for. Our analysts validate and de-duplicate before anything reaches your engineers; they recommend a move and your team applies it. The analyst never moves a report themselves.
Scope a Bug Bounty Program.
Bug Bounty Program is already selected below. Tell us what you are trying to protect and what is driving the timing — if a different service fits better, we will say so rather than sell you this one.