October 19, 2026
Could This Have Been a €1,000 Bug? My First Accepted Bug Bounty Report
From Out of Scope to Accepted: My journey to my first accepted security finding.
By Vicricsec
2 min read
About Me
Hi, I'm Vikas Meena(Vicricsec), a cybersecurity researcher, bug bounty hunter, website developer, and digital marketer. I've worked on movie promotion campaigns, including Krishna and Chitthi, and marketing for an upcoming movie featuring Sapna Choudhary.
This is the story of my first accepted bug bounty report and what I learned along the way.
How I Found the Issue
During manual reconnaissance, I discovered a publicly accessible resource associated with a container repository.
I noticed that it appeared to allow access without authentication, so I investigated further instead of making assumptions.
Using Burp Suite, I inspected HTTP requests and responses, examined the accessible metadata, and assessed the potential security impact.
My methodology involved:
- Manual reconnaissance
- Verifying authentication requirements
- Analyzing exposed resources
- Assessing potential impact
- Documenting evidence and recommending remediation
The investigation revealed an access control issue that could expose internal repository information and container-related resources.
From Out of Scope to Accepted
After submitting my report, I received an unexpected decision: Out of Scope.
It was disappointing, but I remained professional and continued learning.
Later, the company reviewed the report again. On 2 June 2026, it confirmed that the finding was legitimate and needed to be fixed.
My report was finally Accepted — my first accepted bug bounty finding!
Figure 2: My report's journey from Out of Scope to Accepted.
Why Did I Receive Only €50?
The affected asset was classified as Tier 3 under the program's reward structure. This asset did not offer standard payouts for the applicable severity categories.
Although the finding was accepted, the company awarded me a €50 company bonus.
Could a similar vulnerability on a bounty-eligible asset potentially receive €1,000 or more? Possibly, depending on the impact, severity, and program rules. However, €1,000 was not the official valuation of my finding.
What I Learned
- An initial rejection isn't necessarily the final outcome.
- Manual testing and careful observation matter.
- A strong report explains realistic security impact.
- Clear evidence and reproduction steps help security teams.
- Always follow program rules and responsible disclosure requirements.
Final Thoughts
This experience was about more than a €50 bonus. It was my first accepted report and a reminder to keep learning, improving, and hunting.
The journey wasn't straightforward, but it taught me the value of persistence, technical investigation, and professional communication.
Thanks for reading!
— Vikas (Vicricsec)