# Bug Bounty Starter Path Checklist

Use this before spending serious time on a public bug bounty program.

## Pick the Right Program

- Official program page is current.
- Scope is clear.
- Safe harbor language is readable.
- Out-of-scope testing is explicit.
- Reward table matches your skill level.

## Prepare a Clean Workflow

- Use your own test accounts.
- Avoid customer data.
- Avoid denial-of-service testing.
- Keep notes, timestamps, requests, and screenshots.
- Stop if you encounter sensitive data.

## Write Better Reports

- State impact first.
- Include exact reproduction steps.
- Include affected asset and account context.
- Include minimal proof of concept.
- Include remediation suggestion if obvious.

## Avoid Wasted Effort

- Search known exclusions.
- Watch for duplicate-prone low-severity issues.
- Do not mass-scan.
- Do not use AI-generated reports without verification.
- Focus on exploitability, business impact, and clarity.