AI
The Gap Between Theory and Reality
The bug bounty ideal: researcher finds issue, submits report, company validates, pays bounty, ships fix. In practice, companies send a generic acknowledgment, follow up after three months, then go silent. Denis Smajlović explains why: organizations jump into bug bounty without understanding how much coordination it takes. Legal, PR, and engineering all become stakeholders the moment a real vulnerability lands. Without clear internal principles, even a valid, quickly patched bug can produce a frustrating, unexplained outcome for the researcher.
Why Programs Break Down Internally
Big tech companies often assign bug bounty triage to on-call engineers who already juggle incidents and other work. Smajlović has watched organizations assume half an hour of daily coverage is enough. It never is. Every report requires context switching, internal communication, payout history checks, and follow-up with the researcher. Backlogs grow. Test accounts expire. The program becomes unmanageable. The fix is straightforward: dedicated triage resources with clear ownership, not a rotating on-call slot.
Writing Reports That Get Actioned
Richard Im writes every report assuming the reader has never touched a phone. Clear reproduction steps are non-negotiable. Smajlović adds a counter-point: triagers skip to the reproduction step immediately. They don’t need a copy-pasted OWASP definition of XSS. The format that works is direct: endpoint X has Y parameter that’s not sanitizing Z. LLM-generated reports do the opposite, burying the finding in filler that forces triagers to spend mental energy extracting the actual bug.
Challenging Severity Decisions
Im reported a Google Drive app-lock bypass that let anyone open Drive content through Safari’s share sheet. Google called it out of scope because the phone had to be unlocked first. Microsoft patched his face ID bypass in Microsoft Authenticator quickly, then rated it moderate and blocked disclosure for 90 days. Apple initially placed CVE-2025-24198 outside their payout categories. Im responded by quoting their own policy language, and Apple raised the award by $4,000. Polite, specific pushback citing the program’s own guidelines gets results.
What Functional Programs Actually Do
Programs that work give their triage teams proper test accounts, credits for test purchases, and internal documentation, so most reports get resolved without escalating to engineers. Payout guidelines need to be consistent: Smajlović has seen researchers receive $1,000 for a low-severity bug and $800 for something worse. Internal buy-in from legal and communications has to come before a serious report lands. Without it, the company can’t pay what the researcher deserves and can’t explain why.
Researcher Retention and Program Reputation
Im stopped proactively hunting bugs in Microsoft products after his negative bounty experience. Apple kept his attention partly by raising payouts and communicating clearly. Word travels. Researchers talk to researchers, and a program’s reputation spreads through the community. Smajlović argues programs should also invest in live hacking events, where researchers collaborate in person, often surface harder vulnerabilities, and build direct relationships with the program team. Retaining good researchers costs less than losing them and having to rebuild that pool from scratch.
Q&A
What do you do when a bug looks critical externally but internal safeguards make it unexploitable? Smajlović recommends sharing as much context as the organization allows, being transparent about what can’t be disclosed, and trusting that researchers generally understand corporate constraints. ▶ 42:43
If an organization is starting a bug bounty program, should it handle triage internally or outsource? Smajlović, who runs a bug bounty consulting practice, recommends outsourcing to a team with dedicated experience and community connections, since juggling triage alongside other responsibilities rarely works. ▶ 44:54
Notable Quotes
that’s not fair. I feel the same way. Richard Im · ▶ 10:03
Can all bugs be described like that? No. Denis Smajlović · ▶ 15:47
this frustration comes from somewhere Denis Smajlović · ▶ 32:30
Key Takeaways
- Write reports that let someone with no prior context reproduce the issue step-by-step, without definitions or filler.
- Bug bounty triage on on-call rotation creates backlogs; dedicated resources with proper test accounts fix the problem.
- Polite, specific pushback citing a program’s own policy has reversed decisions and increased payouts.
About the Speaker(s)
Richard Hyunho Im is a senior security engineer and independent vulnerability researcher at Route Zero Security. In under two years of bug bounty work he earned Apple acknowledgments for four CVEs, including CVE-2025-24198 and CVE-2025-24225, credits from Microsoft, Google, and the BBC, and a top-25 ranking in OpenAI’s bug bounty program. His research focuses on overlooked attack surfaces and practical exploitation that challenges assumptions about everyday software security.
Denis Smajlović is an OSCP-certified principal security consultant at Nova Information Security with a background in penetration testing and software development. He specializes in helping organizations build and improve bug bounty programs, working with Fortune 500 companies, global tech firms, and major financial institutions. His focus is translating vulnerabilities into business impact and building productive working relationships between external researchers and internal security teams.