Skip to main content
Bounty rewards are the financial incentive at the heart of a paid bug bounty programme. Hackrate’s bounty system is designed to give you precise, transparent control over how much you pay for each finding — based on the vulnerability’s severity and the tier of the affected target — while still leaving room to recognise exceptional researcher effort through bonus payments. This page explains how the bounty table works, how to configure fixed or ranged payouts, and how to award a bounty (and optional bonus) from the report management view.

​
How bounty amounts are determined

A bounty payout is the intersection of two dimensions: severity and target tier.
  • Severity reflects how dangerous the vulnerability is: Critical, High, Medium, Low, or Exceptional (if your programme enables this tier).
  • Target tier reflects the relative importance of the affected asset to your business. Tier 1 targets are your highest-value assets (core production systems, customer-facing APIs, payment infrastructure); Tier 2 targets are less critical assets (staging environments, internal tools, lower-priority subdomains).
The bounty table maps every combination of severity and tier to a specific payout amount — or a payout range if your programme uses interval-based pricing.

​
The bounty table structure

Your programme’s bounty table has two tiers (Tier 1 and Tier 2) and up to five severity levels:
The Exceptional severity level is optional. It is only available if your programme explicitly enables it in the bounty table configuration. Use it for vulnerabilities that significantly exceed the typical Critical threshold — for example, a fully unauthenticated remote code execution on a core production system.

​
Fixed amounts vs. ranges

Your bounty table can operate in one of two modes:
Every severity/tier combination maps to a single, exact payout figure. When you award a bounty for an Accepted or Resolved report, the system shows the exact amount from the table and you confirm the award.Example fixed bounty table (USD):Fixed amounts provide researchers with complete certainty about what they will earn before they submit, which is a strong motivation for thorough, high-quality reports.

​
Currency

Bounty amounts are denominated in the currency set at the programme level. Hackrate supports USD (US dollars) and EUR (euros). The currency applies to all bounties and bonuses on that programme and is shown throughout the report management interface and the researcher’s payout history.
Currency is set when the programme is created or configured. If you need to change the currency for an existing programme, contact your Hackrate account manager — changing currency mid-programme can cause confusion for researchers who have been operating under a different expectation.

​
Awarding a bounty from the report view

You can award a bounty directly from the report management page once the report has been reviewed and you are ready to reward the researcher.

​
Adding a bonus payment

In addition to the standard bounty, you can award a bonus to recognise exceptional quality, unusual depth of research, or a finding that had particularly significant business impact beyond what the severity score alone captures. The bonus is a separate amount recorded alongside the bounty. Both appear on the report:
  • Bounty — the standard award calculated from the bounty table
  • Bonus — the additional discretionary amount
Both the bounty and the bonus appear in CSV exports, and both are included in the researcher’s payout history.
Consider awarding a bonus when:
  • The researcher provided an unusually detailed write-up with clear remediation recommendations
  • The report was marked Good quality duplicate and you want to acknowledge the effort even though the finding was already known
  • The finding had a real-world impact (e.g. the vulnerability was discovered to already be exploited) that the severity score alone does not fully reflect
  • The researcher was exceptionally responsive and cooperative throughout the triage process

​
Budget management and forecasting

Running a sustainable bug bounty programme requires understanding your bounty spend over time. Use the CSV export from the report inbox with the Bounty and Bonus columns selected to produce a detailed ledger of every reward paid out, filterable by programme, date range, and severity. For forecasting, the bounty table itself is your primary planning tool:
  • Multiply your expected monthly report volume (from historical data or programme benchmarks) by severity distribution to estimate average monthly spend
  • Tier 1 assets drive the majority of bounty spend; if you are adding high-value Tier 1 targets, plan your budget accordingly
  • Range-based tables give you a natural upper bound: your maximum possible payout per report is the Tier 1 Exceptional maximum
Suppose your programme receives roughly 20 valid reports per month with the following severity distribution:
  • 2 Critical (both Tier 1)
  • 5 High (mix of Tier 1 and Tier 2)
  • 8 Medium (mostly Tier 2)
  • 5 Low (Tier 2)
Using the example fixed table above (USD):This kind of estimate gives your finance team a defensible monthly budget figure. Actual spend will vary — especially if an exceptional finding comes in — but the table makes the variance predictable.

​
Frequently asked questions

Yes. You can award a bounty at any point after accepting a report — you do not have to wait until you have deployed a fix. Many programmes award bounties upon Accepted status to reward the researcher promptly, then move the report to Resolved separately when remediation is complete.
Contact your Hackrate account manager if you need to correct a bounty record. Bounty records are tracked with a unique identifier and are linked to the researcher’s payout history, so corrections need to be coordinated to ensure the researcher’s account reflects the right amount.
Standard Duplicate reports are typically not rewarded. However, if you close a report as Good quality duplicate, you can use the bonus field to make a discretionary payment acknowledging the researcher’s quality work without implying you are paying a full bounty for a duplicate finding.
No. Awarding a bounty and changing the report status are independent actions. You can award a bounty while the report is in Accepted status and close it as Resolved later, or you can close it first and then award the bounty. The order is up to your programme’s internal workflow.