# How Bug Bounty Programs Work

> Learn what a bounty program is, who reads your report, how platforms and VDPs differ, and set up a safe workspace before you test anything.

Canonical: https://codelivly.com/rooms/how-bug-bounty-programs-work
Last updated: 2026-11-15

| | |
|---|---|
| Level | Beginner |
| Category | Cybersecurity |
| Lessons | 6 |
| Estimated time | 2 h 40 min |
| XP | 150 |

Before you test a single host, you need to know how a bounty program works. This room follows the fictional Harborline program on the Reefline platform from its policy page to your own testing workspace. You learn who the hunter, platform, triager and program owner are, how public and private programs differ, what a VDP is, and which states a report passes through on its way to a payout. You also see the program from the company side, so you know what a security team pays for and what it counts as noise. Every lesson has a terminal exercise on lab files and scenario questions that need judgment.

## Lessons

1. What is Bug Bounty & Why It Matters (25 min)
2. Platforms, Public Programs, and Private Invites (25 min)
3. VDPs vs Paid Bounty Programs (25 min)
4. The Life of a Report from Submission to Payout (25 min)
5. Program Owner's View: Why Companies Run Bounties (25 min)
6. Guided Lab: Set Up Your Hunter Profile and Testing Environment (35 min)

## Related

- [Learning path: Bug Bounty Workflow & Disclosure](https://codelivly.com/learning-paths/bug-bounty-workflow-and-disclosure)
- [All rooms](https://codelivly.com/rooms)