Private bug bounty
What a private bug bounty is, and when it beats a public one
A public programme asks you to announce your weaknesses to the internet and hope the people who answer are trustworthy. A private one does the testing without the announcing. Here is the actual mechanism, and the cases where it is the wrong answer.
The mechanism
A private, invitation-only programme differs from a public one at four points. Each is a decision, and each has a cost.
Researchers are invited, not self-selected
On a public programme anyone with an email address can begin testing within minutes, and nobody has established who they are. On a private one, identity is verified — a government document checked by a person against the details on file — before an invitation is sent. That is a smaller pool. It is deliberately a smaller pool.
The scope is named, and it is yours
You define what may be tested, for how long, and what is off limits. Nothing outside that is authorised. The practical difference from a policy document is whether the boundary is enforced by software or by good intentions: an authorisation check on every request either refuses out-of-window access or it does not.
Testing begins only after the paperwork exists
An NDA and a written testing authorisation, signed, naming what may be tested and when. This protects both sides and it is not ceremonial: a researcher without written authorisation is, depending on jurisdiction, committing an offence, and a client who has not signed a scope cannot say afterwards what was agreed.
Publication is a decision, not a countdown
Public programmes generally disclose by default after a fixed period; you are negotiating against a clock somebody else started. On a private programme nothing about your systems becomes public unless you approve it. The version worth asking for is one where that approval is a step in the software rather than a clause in a contract — where the platform holds a record of the exact wording you agreed to and refuses to publish anything else.
Where the two genuinely differ
| Public programme | Private programme | |
|---|---|---|
| Who tests | Anyone who registers | Identity-verified, invited individually |
| Who knows | You are named publicly | Not announced; researchers do not receive your organisation or its officers |
| Duration | Runs indefinitely | An authorised window with a start and an end |
| Report volume | High, with duplicates and noise | Lower, every finding validated and scored by our team |
| Disclosure | Usually default, on a timer | Only with your approval |
| Breadth | Very wide — its real strength | Narrower by design |
That last row is the honest cost. A public programme's scale is a genuine advantage: thousands of people looking will, over time, find things a controlled panel will not. If your product is consumer-facing, already public, and you have the capacity to triage a heavy inbound queue, a public programme may simply be the better instrument. Anyone who tells you private testing dominates on every axis is selling.
What it costs
The model worth looking for is one where you are not buying time. A penetration test sells days: you pay whether or not anything is found. A bounty model sells outcomes.
At Exception Security specifically: no subscription, no setup fee and no retainer. You are billed only for a finding you have accepted, at a reward you set before testing begins. If nothing is found, there is nothing to pay. That is not a promotion — it falls out of how the platform is built, because every invoice line is generated from an accepted finding and there is no other mechanism that can charge you.
When this is the wrong choice
Three cases, and they are common.
- You have no way to receive a report at all. Publish a disclosure route first. It costs almost nothing and it is the prerequisite, not the upsell.
- You cannot fix what you find. Testing produces a queue. If nobody has time to remediate, you have bought a list of things you now knowingly have not fixed — which is worse than not knowing, both practically and in front of a regulator.
- You need a fixed scope on a fixed date. Compliance frequently requires an assessment completed by a deadline with a report in a particular shape. Bounty models are poorly suited to that; a scheduled penetration test is the right tool.
Exception Security runs private, invitation-only engagements: identity-verified researchers on a scope you name, under NDA and written authorisation, with every finding validated and scored by our team, and nothing published without your approval. Enquiries are answered individually — there is no self-serve tier. support@exceptionsecurity.com