Pricing
What a private bug bounty costs
You decide what each finding is worth before testing starts, and you pay only for findings you accept. There is no subscription, setup fee, retainer or minimum. If nothing is found, there is nothing to pay.
How you are charged
- You set the reward for each severity (low, medium, high, critical) before testing begins.
- You pay only for a finding you accept. Our team validates and scores every finding before it reaches you; a finding you reject costs nothing.
- Nothing else can charge you. Every invoice line is generated from an accepted finding; the platform has no other mechanism that bills a client.
- No fee on top of the rewards you approve.
An example reward table
A starting point, not a price list: you choose your own numbers. These are rounded down, in rupees, from the baseline in Bugcrowd's public guide Defensive Vulnerability Pricing Model for moderately tested web apps and APIs. That guide also notes that many programmes start lower and raise rewards over time, and that companies holding financial or personal data often pay more.
| Severity | Example reward per accepted finding |
|---|---|
| Low | ₹10,000 |
| Medium | ₹40,000 |
| High | ₹1,00,000 |
| Critical | ₹2,50,000 |
How each finding is scored is public: how we score a finding. What you receive for each one: a labelled sample finding.
A first engagement with a ceiling
Most teams start small: two weeks, one app or API, and a total ceiling you choose. We close the engagement when accepted rewards reach that ceiling, so the most you can spend is a number you picked. Nothing starts until you have signed off the scope, the NDA and the written testing authorisation.
What is free
A managed vulnerability disclosure page in your company's name: a proper place for anyone who finds a flaw to report it. We read every report, discard the noise, and pass on only what is real, with steps to reproduce. No contract, no access to your systems. How the free programme works.
When it is the wrong fit
- You need a fixed scope on a fixed date for a compliance deadline. A scheduled penetration test is the right tool; this runs alongside it, not instead of it.
- You need a CERT-In empanelled audit. This is not one and does not replace one.
- Nobody can fix what is found. Testing creates a queue; without someone to work it, it is a list of known, unfixed problems.
Questions about a budget or a reward table for your stack: write to founder@exceptionsecurity.com, or create your company account at exceptionsecurity.com and our team will set up your private programme with you.