I Found a Bug in a VDP. No Money. No Bounty. Here’s Why I’d Do It Again.

Everyone told me to skip the programs that don't pay. They were wrong.

I found a bug last month. It didn't pay anything.

Not a single dollar. Not a gift card. Not even a t-shirt.

I reported it to a Vulnerability Disclosure Program — a VDP. The organization confirmed it, fixed it, and added my name to their security acknowledgments page.

That's it. That's the whole reward.

And I'd do it again.

Why I Almost Skipped It

When I started learning bug bounty, every guide said the same thing: "Focus on programs that pay. Don't waste your time on VDPs."

The logic made sense. I'm not doing this for fun. I'm doing it to build a career, maybe earn some money along the way. Why spend hours on a target that won't pay?

So I ignored VDPs for months. I only looked at paid programs. I competed with thousands of other researchers for the same bugs. I got closed out, ignored, and rejected.

Then I read something that changed my mind.

The Thing That Changed My Mind

I was reading an interview with a security engineer at a major company. They said something I couldn't stop thinking about:

"Many important projects pay no bounty at all. They still get reports, sometimes a lot of them, because public credit matters. A CVE, advisory credit, or a 'reported by' mention is very meaningful for career capital."

Career capital.

Not cash. Not a payout. Career capital.

I'd been thinking about bug bounty as a way to make money. But the researchers who are actually building careers aren't just chasing bounties. They're building proof of work.

A confirmed bug in a VDP is proof. A security advisory with your name in it is proof. A hall of fame entry is proof.

Proof doesn't expire. Proof doesn't get closed as "informative." Proof is something you can point to — in a job interview, on a resume, in a conversation with a recruiter.

What I Actually Found

I can't name the organization. Disclosure rules. But here's what I can tell you.

It was a small VDP. Not a household name. Not a company with a flashy bounty program.

I spent two weeks testing their application. Not because I expected to find something big. Because I wanted to understand how it worked.

The bug was simple. An API endpoint that returned more data than it should. Not critical. Not a full account takeover. But a real data exposure issue.

I wrote the report. Steps to reproduce. Screenshots. Impact statement. Suggested fix.

They responded in two days. Confirmed the bug. Fixed it in a week. Added my name to their acknowledgments page.

No money. But I can point to it now. It's searchable. It's proof.

Why This Matters More Than I Expected

I've been hunting for months. I've found one confirmed bug on a paid program. I'm waiting to be paid.

But the VDP bug felt different.

Not because it was more technically impressive. It wasn't. Not because the organization was more important. It wasn't.

Because it was mine. I found it. I documented it. I wrote the report. I didn't get lucky with a duplicate. I didn't get closed out by a triager who didn't have time to read carefully.

I did the work, and someone confirmed it was real.

That's the feeling I've been chasing. Not the payout. The confirmation.

What I'm Doing Differently

I'm still hunting on paid programs. I still want to earn bounties. But I've changed how I think about where to spend my time.

First, I'm treating VDPs as valid targets. Not as a consolation prize. As a way to build proof of work while I'm still learning. A confirmed bug in a VDP is worth more than a closed report on a paid program.

Second, I'm looking for programs that offer credit, not just cash. A CVE. A hall of fame entry. A security advisory mention. These are credentials. They don't expire.

Third, I'm remembering that the path isn't linear. Some researchers find their first bug on a paid program. Some find it on a VDP. Some find it after months of nothing. The path doesn't matter. The proof does.

The Uncomfortable Truth

I found a bug. It didn't pay anything. I'd do it again.

Not because I'm noble. Because I'm building something. Not a bank account. A reputation. A track record. Proof that I can do this work.

The money will come. Or it won't. But the proof is mine.

If you're also learning to build proof of work — one confirmed bug at a time — I write about what I'm actually figuring out. Follow for more field notes from the bottom of the learning curve.