lesis-lat/bug-bounty-programs-rewards

Overview

This dataset is part of a research project Economic Taxonomy of Software Vulnerabilities, which aims to estimate the monetary cost associated with software vulnerabilities based on real-world bug bounty program data. The core objective is to provide a concrete, data-driven reference for evaluating the average cost of discovering and reporting vulnerabilities across different severity levels.

Methodology Summary

The dataset was generated following these steps:

1. 1.Data Collection Bug bounty program data was scraped from multiple platforms: HackerOne, Bugcrowd, YesWeHack, Intigriti, BugHunt, and Bugpay.

1. 1.Filtering Only programs with monetary rewards and severity classification were retained. Vulnerability Disclosure Programs (VDPs) and programs with inconsistent data were excluded.

1. 1.Severity Classification Rewards were grouped into the following severity categories:
2. 2.Low
3. 3.Medium
4. 4.High
5. 5.Critical

1. 1.Normalization
2. 2.Only the minimum value from each reward range was retained (conservative estimate).

Dataset Fields

Each row in the dataset corresponds to a unique program and contains the following fields:

Note: for programs with Private visibility, the name has been replaced with an MD5 hash to censor sensitive information and prevent potential data leakage.

Intended use

This dataset is designed to support:

• —Academic research on cybersecurity economics
• —Development of security investment models
• —Cost-benefit analysis of vulnerability management strategies
• —Industry benchmarks for vulnerability prioritization and ROI estimation

Limitations

• —Zero-day vulnerabilities and unreported cases are not covered.
• —The data only reflects discovery phase costs, not full lifecycle costs (e.g., mitigation or incident response).
• —Reward values are based on disclosures and may not include negotiation or bonuses.