Bug bounties: The good, the bad, and the frankly ridiculous ways to do it

The piece surveys three decades of bug bounty programs, tracing their growth from early controversy to mainstream adoption by tech giants and specialized platforms, and weighing trade-offs between running programs in-house versus outsourcing. It explores researcher motivations (financial rewards, recognition, and desire to see fixes), notes hybrid operational models and recruitment benefits, and cautions against PR-driven bounties. The article also highlights the rising influence of AI—both increasing report volume and noise and aiding moderation and automation—while arguing human intuition remains crucial for high-impact vulnerability discovery.