Explain like I'm five · Security

What is a Bug Bounty?

Bug bounties, told as a story about a poster on the castle gate: cracks wanted, reward offered.

one carpentera thief who comes once a yearthe castle keeps growing, but only two people look for cracks

The castle keeps growing, but only two people look for cracks.One carpenter and a hired thief who comes once a year. Every new tower brings new cracks.

I saw a crack… who do I tell?hundreds of eyes in the villagewith nowhere to tell, some will sell it at the bad market

The village has hundreds of eyes. But nowhere to tell.When someone who spots a crack has nowhere to tell, they walk on — or sell it at the bad market.

CRACKS WANTED — REWARDanyone may lookfound one? tell us quietlybreak nothing, open no chestsconfirmed? reward by size of cracka bug bounty is this one poster on the gatethe whole village helps look for cracks

A bug bounty is one poster on the castle gate.Anyone may look for cracks. Tell us quietly with a note, and once confirmed you're rewarded by the size of the crack. Just break nothing, and open no chests.

Anyonethe whole village looks
A quiet noteto us, before the rumor
Confirm firstis it real, is it new?
Reward by sizecoins for small, a pouch for big
the notereal? new?small crack$big crackreward by sizethe boardsecret from the village until it's fixed — then you may brag

A note comes in: confirm it, pay it, board it up.The guard room checks whether it's real and whether it's already known. It stays secret until fixed — after that, the finder may brag.

hundreds of eyes around the castlethe ones who spot a crack before the thief are on our sidea pentest is one person once; a bounty is everyone, always

Now there are hundreds of eyes around the castle.The ones who spot a crack before the thief are on our side now. A pentest is one person once; a bounty is everyone, always.

In one breath

Bug bounty = a poster on the gate — anyone who finds a crack and sends a quiet note gets a reward by size once confirmed, and the crack gets boarded up.

A public program where any outside researcher can find vulnerabilities, report them under set rules, and be paid by severity once verified.

When grown-ups say it

Bug bounty
The reward poster. One reward per crack; the bigger the crack, the bigger the reward.
Vulnerability disclosure policy
The poster without a reward. A poster that only says where to tell. No money, but now there's somewhere to go.
Scope
Where you may look. The main keep, yes; the king's bedroom, no. Written on the poster in advance.
Coordinated disclosure
Secret until fixed. Us first, the village after the board goes up. → the hole nobody knows
Severity
Size of the crack. A crack a cat fits through and a crack a thief walks through pay differently.
Duplicate
A note we already have. Only the first note about a crack gets the reward.
Bounty platform
The village noticeboard keeper. Puts up the poster, collects the notes, and hands over the rewards.
Pentest
One hired thief. Set time, set person; a bounty is the opposite. → the thief we hired
Next story
The Crack Ledger →
Want another term as a picture book? Request →