What a bug bounty actually pays per hour

The Write tool is disabled, and the task is to return the post itself. Here it is:

The headline number, and the number underneath it

In March 2019, a 19-year-old from Buenos Aires named Santiago Lopez became the first person to earn a million dollars finding software bugs. He hacked under the handle @try_to_hack, mostly self-taught from online tutorials, and HackerOne turned him into a marketing icon: proof that a teenager with a laptop and no computer science degree could out-earn a senior engineer at a bank. By August that year, five more hunters had crossed the same threshold. Today more than thirty people have each earned over a million dollars on the platform, and one has passed four million, according to HackerOne's own tally. Those numbers are real. They are also almost useless for answering the question most people actually have, which is: if I sat down and did this, what would an hour of my time be worth? The honest answer is that a bug bounty pays somewhere between nothing and several thousand dollars an hour, and which end of that range you land on has less to do with skill than the structure of the game itself. That structure is worth understanding, because it explains why the same activity can make one person a millionaire and leave another working below minimum wage for the identical hours.

A bug bounty program, for the uninitiated, is a standing offer: a company publishes the rules of what parts of its systems you may attack and how much it will pay for different classes of security flaw, and anyone in the world can go looking. Find a valid vulnerability, write it up, and if you are the first to report it and the company agrees it is real, you get paid a "bounty." Platforms like HackerOne and Bugcrowd act as marketplaces, connecting thousands of these programs to a global pool of freelance hackers, handling the paperwork and taking a cut. It is gig work, in other words, with all the flexibility and all the precarity that implies.

Why the hourly wage is a slippery number

The first thing to grasp is that you are not paid for your time. You are paid for outcomes, and only for outcomes nobody reached before you. This is what economists call a tournament. Everyone competes to find the same bugs in the same code, but the reward goes only to the first valid submission of each distinct flaw. The academic literature is blunt about this. A 2023 USENIX Security paper by Omer Akgul and colleagues, which surveyed and interviewed working bug hunters, describes a "tournament-like setting" in which duplicated effort is simply wasted. You can spend twenty hours on a genuine, exploitable bug, write a flawless report, and earn zero dollars because someone else filed the same finding six hours earlier. Your labor was real; your pay was not. That single fact makes any clean hourly figure a fiction. The platforms report gross payouts, never the hours behind them, so the denominator in "dollars per hour" is invisible by design. What we can do is triangulate from three things: how income is distributed across hunters, how many hours they say they work, and the handful of people who have carefully logged their own time. None of those three sources is perfect. Survey data relies on self-report and skews toward people willing to talk. Platform totals are inflated by a tiny number of superstars. And self-trackers are, almost by definition, unusual. But together they sketch a picture that is far less flattering than the millionaire press releases.

What most hunters actually take home

Start with distribution, because it is where the story really lives. HackerOne paid out $81 million in bounties between July 2024 and June 2025, a 13 percent increase over the prior year. That sounds like a lot until you divide it across the tens of thousands of registered hackers. The platform's own figures show that its top 100 all-time earners have collectively banked $31.8 million, a large slice of everything ever paid. The money is not spread out. It is stacked. The academic survey puts numbers on that concentration. Among the 159 hunters Akgul's team surveyed in detail, the largest group reported earning between $1,000 and $30,000 a year from bug bounties, a meaningful chunk reported under $1,000, and only twelve people, fewer than one in ten, reported taking home $75,000 or more. Crucially, most respondents worked part-time: a large share put in fewer than ten hours a week. Bugcrowd's 2024 "Inside the Mind of a Hacker" report, based on around 1,300 of its hackers, agrees on the shape of things, finding that 59 percent hack fewer than 14 hours a week and that many treat it as a side pursuit rather than a career.

Independent analyses that pool platform data reach a similar conclusion. One detailed breakdown of bug bounty economics estimates that something like 35 to 45 percent of hunters earn nothing at all in a given year, that roughly 40 percent of people who submit at least one report never receive a single bounty, and that only one to two percent clear six figures. These figures come from a platform-adjacent source rather than a peer-reviewed study, so treat the exact percentages as directional. But the direction is not in dispute: this is a market where a few people earn extraordinary sums and most earn little or nothing. That pattern, a long tail beneath a handful of stars, is the same shape you see in acting, music, and professional poker. The average is dragged upward by outliers to the point where it describes almost no one.

Doing the division

So what is an hour actually worth? The clearest way to reason about it is to work from a typical bug and a typical effort. The bounty for a single valid finding on the major platforms scales with severity. A low-severity issue might pay a hundred to a few hundred dollars; a medium one, several hundred to a thousand; a high or critical one, a few thousand and up. Critical vulnerabilities on HackerOne averaged $3,384 as far back as 2019, and the ceiling has climbed since. But the median bug, the one in the middle, is a modest finding worth a few hundred dollars, and finding, verifying, and documenting it properly can easily eat ten to forty hours once you count reconnaissance and the write-up. Run that division and you land at roughly $10 to $50 an hour for competent work, before you subtract the hours spent on the bugs that turned out to be duplicates or got rejected. The self-trackers land in the same neighborhood, sometimes lower. The economics breakdown cited above describes a hunter who logged 782 hours over 150 days and earned $5,650, which works out to $9.80 an hour, below the minimum wage in most of the countries where hunters live. That is a single person's experience, not a population average, and someone else might log the same hours during a lucky month and clear ten times as much. But it usefully punctures the fantasy. The same analysis estimates that even skilled hunters in the top five to ten percent are effectively earning something like $24 to $72 an hour once you account for all their working time. Now set that against the alternative. The same skills applied as a salaried application security engineer, or billed out as a freelance penetration tester at the going rate of $200 to $400 an hour, pay far more reliably and come with the small luxuries of a steady paycheck, paid time off, and not competing against the entire internet for every dollar. For the overwhelming majority of people who try it, bug bounty hunting is a worse hourly deal than the day job their skills would command. What it offers instead is optionality, the small chance of an enormous single payout, and, for people in countries where local wages are low, a genuinely life-changing multiplier: HackerOne has noted that a top earner can make more than 40 times the median annual wage in Argentina. Geography changes the math completely. The same $30,000 that is a mediocre year in San Francisco is a spectacular one in much of the world, which is exactly why the millionaire success stories so often come from Argentina, India, and Eastern Europe rather than California.

The confusion the industry quietly benefits from

There is a persistent misconception worth clearing up, because it inflates people's expectations before they start. Many newcomers conflate two different things: getting paid to hunt for bugs, and being allowed to report them safely. Katie Moussouris, who built Microsoft's first bug bounty program and helped design the U.S. military's, has spent years warning that bounties and disclosure are not the same thing and should not be treated as interchangeable. A vulnerability disclosure program is a legal promise that if you find a flaw and report it responsibly, the company will not sue you. A bug bounty attaches money to that promise. Most of the internet's security depends on the first kind, the unpaid kind; the paid tournaments sit on top of a much larger base of volunteer and salaried work.

This matters for the hourly question because the research finds that money is not even the only reason people do it. In the USENIX study, the two most important benefits hunters cited were monetary rewards and, right alongside them, learning new skills, while reputation, often assumed to be a big motivator, turned out to be one of the least important. Some interviewees said they reported bugs to companies that offered no money at all, simply to learn or to feel useful. When a meaningful fraction of your workforce is partly working for the education, the market can sustain hourly rates that pure economics would never support. The platforms are, in effect, being subsidized by their own hunters' curiosity. The same study catalogs the frictions that eat into effective pay: slow or unresponsive program managers, disputes over how severe a bug is and therefore how much it pays, and the sheer volume of what hunters called "too much labor work," the menial grind of setting up test accounts and re-checking scope. "Stress and uncertainty," including irregular income and the fear of burning out, shows up as a distinct, named challenge. None of that appears in a dollars-per-bug figure, but all of it is time.

Where the real money concentrates

If the median experience is grim, the top of the market is genuinely lucrative, and it is worth understanding what separates the two, because it is not simply talent. The biggest, most reliable money is in private programs, invitation-only tournaments that established hunters get access to after building a track record. They have fewer competitors, which means fewer duplicates and better odds that your work gets paid, and they often pay multiples of what comparable public programs offer. The single largest payouts come from a small set of deep-pocketed technology companies. Google, whose Vulnerability Reward Program is one of the oldest, paid out nearly $12 million in 2024 across more than 600 researchers, with a single Chrome bug earning $100,115. Its published ceilings are eye-watering: up to $250,000 for the right Chrome exploit and up to $300,000 for critical flaws in top-tier Android apps. Those numbers, spread over the weeks a serious exploit chain can take, are where the hundreds-of-dollars-an-hour outcomes actually happen.

Live hacking events concentrate the money even further. These are invitation-only competitions where top hunters gather to attack a single target over a weekend, and the payouts are dense: Google's BugSWAT events in Las Vegas and Málaga handed out $370,000 combined in 2024, and HackerOne's early H1-702 event famously paid out more than $1.9 million in three days. The government got into the act in 2016 with "Hack the Pentagon," the first federal bug bounty, which Moussouris helped design; the U.S. Department of Defense has run vulnerability programs ever since. The people who do well share a pattern. They specialize in a narrow, high-value target class, they get into private programs, they move fast to beat the duplicate clock, and they treat it as a full-time discipline rather than a hobby. Even then, income is lumpy. One hunter interviewed for the research described monthly earnings that swung from zero to tens of thousands depending on whether a big bug landed that month. An "hourly rate" averaged over a career like that is a number no one experiences in real time.

The AI shock, and what to watch next

The most interesting development in bug bounty economics right now is that the per-hour math is being rewritten from an unexpected direction: automation, but not the kind hunters hoped for. Large language models turned out to be excellent at generating plausible-looking vulnerability reports and terrible at finding real vulnerabilities. The result has been a flood of what maintainers call "AI slop." Daniel Stenberg, who leads the widely used curl project, documented the collapse in mid-2025: by that point roughly 20 percent of all submissions to curl's program were AI-generated garbage, while only about 5 percent turned out to be genuine bugs. In six years of AI-assisted reports, Stenberg wrote, not one had ever found a real vulnerability. Each junk report still had to be read and disproved by three or four members of a seven-person team, "sometimes up to an hour or three. Each," plus what he called the emotional toll. In January 2026, curl removed the cash rewards from its program entirely to kill the incentive, after paying out roughly $90,000 over the program's lifetime for 81 real flaws. curl is a volunteer project, but the same wave hit the commercial platforms. Bugcrowd reported that submissions more than quadrupled during a three-week stretch in early 2025, the great majority of them false positives. HackerOne's latest report shows the two-sided nature of the shift: genuine AI-related vulnerabilities are rising fast, with prompt-injection reports up 540 percent year over year, even as AI-generated noise clogs the queues, and 70 percent of surveyed researchers now use AI tools in their own work. For the hourly question, this cuts two ways. More noise means more triage time for programs, which pushes them toward stricter filters, reputation gates, and private-by-default models, all of which make it harder for newcomers to earn their first dollar and easier for established hunters to defend their turf. But AI also raises the productivity of people who use it well, letting a skilled hunter cover more ground per hour. The likeliest outcome is a market that pays its top decile even better and its bottom half even less, widening a distribution that was already among the most unequal in skilled work. Which returns us to the question we started with. A bug bounty pays what a lottery ticket pays: almost nothing on average, spectacularly for a few, and the price of admission is your time. The interesting thing is not the number. It is that tens of thousands of capable people keep buying tickets anyway, and that a growing share of the internet's security now rests on whether they keep doing it. Watch what happens to entry-level hunters over the next two years. If the AI filters lock them out, the pipeline that produced the next Santiago Lopez may quietly close, and the industry may discover it valued the million-dollar headline more than the people who made it plausible.

Sources

1. HackerOne, "Six Hackers Break Bug Bounty Record, Earning Over $1 Million Each on HackerOne" (2019)
2. HackerOne, "Hackers Surpass $300 Million in All-Time Earnings on the HackerOne Platform" (2023)
3. BleepingComputer, "HackerOne paid $81 million in bug bounties over the past year" (2025)
4. Omer Akgul et al., "Bug Hunters' Perspectives on the Challenges and Benefits of the Bug Bounty Ecosystem", USENIX Security Symposium (2023)
5. Bugcrowd, "Inside the Mind of a Hacker: 2024 Edition" (2024)
6. bug-bounties.as93.net, "Bug Bounty Economics: What Hunters Actually Earn (With Real Data)" (2025)
7. Google Security Blog, "Vulnerability Reward Program: 2024 in Review" (2025)
8. CSO Online, "Katie Moussouris: It's dangerous to conflate bug bounties and vulnerability disclosure" (2018)
9. Daniel Stenberg, "Death by a thousand slops" (2025)
10. Cybernews, "Curl creator says AI might kill bug bounties" (2025)
11. Computing, "Bug bounty platforms battle rise in AI-slop reports" (2026)