I Tested the Same Bug on 3 Programs. Only One Paid Me. Here’s What I Learned About Picking Targets.

Same vulnerability class. Same testing process. Three completely different outcomes.

I found the same bug three times.

Not the exact same endpoint. Not the same company. But the same vulnerability class — a broken access control issue that let one user access another user's data.

I reported it to three different programs over two months.

One paid. One closed it as "informative." One never responded.

Same bug. Same skill. Same effort. Wildly different outcomes.

The Three Reports

I can't name the programs. Disclosure rules. But here's what I can tell you.

Program A was a large public program on HackerOne. Thousands of researchers. Well-known company. The bug was an IDOR in a user profile API — changing the user ID in a request returned another user's email and phone number.

Program B was a smaller program on Bugcrowd. Less competitive. Newer scope. The bug was almost identical — same IDOR pattern, same data exposure.

Program C was a VDP on a self-hosted platform. No bounty. No cash. Just a "thanks" and a spot in their hall of fame.

Same bug class. Same testing process. Three completely different responses.

What Happened

Program A paid $500. It took three weeks to triage. The triager asked for a video PoC (I hadn't included one). I made the video. They confirmed the bug. Paid.

Program B closed the report in 48 hours. The reason: "This object is intended to be public." I argued. They didn't respond. I moved on.

Program C responded in two days. Confirmed the bug. Fixed it in a week. Added my name to their security acknowledgments page. No money. But I can point to it. It's searchable. It's proof.

I spent the same amount of time on all three. The difference wasn't my skill. It was where I pointed my tools.

The Thing I Realized

I've been picking targets wrong.

I've been chasing the biggest programs — the ones with the flashiest scopes, the biggest names, the highest max bounties. The ones that look impressive on a resume.

But the data says something different. The smaller programs — the ones with fewer researchers, newer scopes, less saturation — are where the signal-to-noise ratio is better. Where a legitimate report is more likely to be read carefully. Where the triager isn't drowning in a thousand AI-generated submissions.

The GitHub payout restructuring proved this. Programs with fewer than 50 researchers had 15x higher ROI than programs with 500+ .

Vercel's Platform Protection program had 34 participants and an average bounty of $50,000**. Coinbase had 771 participants and an average bounty of **$200.

Same effort. Same skill. Wildly different outcomes.

What This Means for Beginners

I've found one confirmed bug. I'm waiting to be paid. I'm still learning.

But I know now that the target matters as much as the technique.

A beginner who picks the right program can find a $500 bug in a week. A beginner who picks the wrong program can find the same bug and get closed as "informative" in 48 hours.

The difference isn't skill. It's selection.

What I'm Doing Differently

First, I'm checking participant counts before I invest time. A program with 34 researchers is worth more of my attention than a program with 1,276. Not because the bugs are easier — because the competition is thinner.

Second, I'm looking at average bounty, not max bounty. A program with a $500,000 max bounty sounds amazing until you realize the average payout is $200. A program with a $50,000 max bounty and a $50,000 average is a different game entirely.

Third, I'm treating VDPs as valid targets. A hall of fame entry or a CVE doesn't pay rent, but it's proof of work. It's something to put on a resume. It's a credential that doesn't expire.

The Uncomfortable Truth

I found the same bug three times. Only one program paid me. The other two are still out there, unfixed or ignored, waiting for someone else to find them and submit them to a program that actually cares.

The bug didn't change. The payout did. The only variable was where I aimed.

I don't know if I'll find my next bug on a program with 34 researchers or 1,276. But I know now that the choice matters.

And I'm choosing differently.

If you're also learning to navigate the bug bounty economy — where to hunt, not just how — I write about what I'm actually figuring out. Follow for more field notes from the bottom of the learning curve.