Bug › Module 2 › Lesson 2
Program Types
Public bounty, VDP, private invite, and hybrid programs — know which type covers YOUR $SCOPE_HOST.
Visual · bounty_program_types
Program types literacy. $SCOPE_HOST only. Original Cyberlium.
Opening
Program type tells you what reward and rules apply — not which random site to scan.
Bug bounty programs vary: public bounties pay for valid findings on listed scope; Vulnerability Disclosure Programs (VDPs) may offer recognition without payment; private invites restrict researcher access; hybrid programs mix assets and reward tiers. Each type still requires enrollment and scope compliance on $SCOPE_HOST. Cyberlium teaches program-type vocabulary so you read YOUR program correctly. You will NOT assume every VDP allows aggressive scanning or treat 'responsible disclosure' pages as dorm-target licenses. Next: Picking Programs.
1. Public bounty vs VDP
Public bounty programs publish monetary rewards for qualifying vulnerabilities on in-scope assets like $SCOPE_HOST. VDPs focus on coordinated disclosure — sometimes no payment, often stricter communication rules. Both require staying in scope.
A VDP on a vendor site you did not enroll in is not your homework target. Enrollment and asset listing govern authorization.
Command guide
Try these commands — Public bounty vs VDP
═══ LINUX / macOS (Web & API Security Testing) ═══
Test HTTP methods on authorized lab endpoint
Command — copy this
for method in GET POST PUT DELETE OPTIONS; do
curl -s -o /dev/null -w "%-8s -> Status: %{http_code}
" -X $method "http://${LAB_HOST:-127.0.0.1}/api/v1/user"
doneTest JSON API with Authorization Bearer header
Command — copy this
curl -s -X POST "http://${LAB_HOST:-127.0.0.1}/api/v1/profile" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <TEST_TOKEN>" \
-d '{"id": 1, "action": "view"}' | jq . 2>/dev/null || catCheck for CORS misconfiguration headers
Command — copy this
curl -s -I -H "Origin: https://attacker.com" "http://${LAB_HOST:-127.0.0.1}/api/v1/status" | grep -i "Access-Control"Primary tools to practice this lesson: curl, python3. Reference sites: Platform triage; Report quality. Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Private and hybrid programs
Private programs invite selected researchers — scope may be wider but access is gated. Hybrid programs split tiers: some assets pay bounties, others are VDP-only. Read which tier $SCOPE_HOST falls under.
Invite-only access does not expand to classmate deploy URLs or café sites — still one program, listed assets.
3. Program type does not expand scope
A generous bounty table for Asset A does not authorize Asset B. Program type describes rewards and access; scope lists hosts. Both live beside $SCOPE_HOST in your notes.
Ship: one-line label — which program type covers YOUR $SCOPE_HOST. Next: Picking Programs.
4. What you ship: program type label for $SCOPE_HOST
Label: public bounty / VDP / private / hybrid. $SCOPE_HOST named. No scope expansion. chmod 600.
5. What you record before the next lesson
Date. Program type for $SCOPE_HOST. File t20-m02-l02-program-types.txt chmod 600.
6. Wrong vs right: random sites vs in-scope program
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Assume VDP means 'scan anything on their brand.' Treat private invite as all-subdomain license.
Right
Label program type for YOUR $SCOPE_HOST. Next: Picking Programs.
Mission: classify YOUR program type
1) Label YOUR $SCOPE_HOST program type. 2) Note reward vs VDP-only if applicable. 3) Confirm type does not expand scope. 4) chmod 600. Never test unlisted assets.
Stuck? Ask Cyberlium AI Mentor
VDP ≠ no rules. VDPs still have scope and forbidden actions.
Knowledge Check
APPLY: A VDP typically:
Multiple choice
Knowledge Check
APPLY: True or False: Higher bounty tiers authorize testing unlisted production databases.
True or False
Knowledge Check
APPLY: Hybrid programs require you to:
Multiple choice