# Bug Bounty Workflow & Disclosure

> How bounty programs work, from picking a program and reading scope to safe harbor, submissions, severity, triage, and responsible disclosure.

Canonical: https://codelivly.com/learning-paths/bug-bounty-workflow-and-disclosure
Last updated: 2026-11-15

| | |
|---|---|
| Level | Beginner |
| Category | Cybersecurity |
| Rooms | 6 |
| Lessons | 39 |
| Estimated time | 18 h 30 min |

Learn how bug bounty programs work before you test anything. You follow one fictional program, Harborline, from its policy page to a paid and disclosed report. You read scope and testing rules, learn what safe harbor does and does not cover, write a submission a triager can act on, score severity with CVSS, argue impact with evidence, and handle duplicates, disputes and coordinated disclosure. Every lesson has a hands-on terminal exercise on lab data and scenario questions that need judgment.

## Rooms in this path

1. [How Bug Bounty Programs Work](https://codelivly.com/rooms/how-bug-bounty-programs-work) - Learn what a bounty program is, who reads your report, how platforms and VDPs differ, and set up a safe workspace…
2. [Choosing Programs & Reading Scope](https://codelivly.com/rooms/choosing-programs-and-reading-scope) - Pick a first bug bounty program that fits your skills, then read its scope, exclusions and testing rules so every…
3. [Legal Safe Harbor & Authorization](https://codelivly.com/rooms/legal-safe-harbor-and-authorization) - Learn what a safe harbor clause promises, why written authorization is what separates research from crime, and how to…
4. [Writing a Bounty Submission](https://codelivly.com/rooms/writing-a-bounty-submission) - Write a vulnerability report a triager can reproduce in minutes: title, summary, steps, safe proof, honest impact and a…
5. [Severity Rating for Bounty Reports](https://codelivly.com/rooms/severity-rating-for-bounty-reports) - Score a finding with CVSS 3.1, read platform priority taxonomies, and argue impact with evidence so your report gets…
6. [Triage Communication & Responsible Disclosure](https://codelivly.com/rooms/triage-communication-and-responsible-disclosure) - Work with a security team after you submit: answer triage questions, handle duplicates and disputes, stay professional,…

## Related

- [Security Monitoring and Compliance Automation](https://codelivly.com/learning-paths/security-monitoring-and-compliance-automation)
- [Software Supply Chain Security](https://codelivly.com/learning-paths/software-supply-chain-security)
- [Secrets Management and Pipeline Hardening](https://codelivly.com/learning-paths/secrets-management-and-pipeline-hardening)