Bug › Module 2 › Lesson 2
Program Types
Public bounty, VDP, private invite, and hybrid programs — know which type covers YOUR $SCOPE_HOST.
Visual · bounty_program_types
Program types literacy. $SCOPE_HOST only. Original Cyberlium.
Opening
Program type tells you what reward and rules apply — not which random site to scan.
Bug bounty programs vary: public bounties pay for valid findings on listed scope; Vulnerability Disclosure Programs (VDPs) may offer recognition without payment; private invites restrict researcher access; hybrid programs mix assets and reward tiers. Each type still requires enrollment and scope compliance on $SCOPE_HOST. Cyberlium teaches program-type vocabulary so you read YOUR program correctly. You will NOT assume every VDP allows aggressive scanning or treat 'responsible disclosure' pages as dorm-target licenses. Next: Picking Programs.
1. Public bounty vs VDP
Public bounty programs publish monetary rewards for qualifying vulnerabilities on in-scope assets like $SCOPE_HOST. VDPs focus on coordinated disclosure — sometimes no payment, often stricter communication rules. Both require staying in scope.
A VDP on a vendor site you did not enroll in is not your homework target. Enrollment and asset listing govern authorization.
Command guide
Try these commands — Public bounty vs VDP
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Platform triage — duplicate checks before filing Report quality — clear steps on in-scope asset
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
python3 -c "print('Pick program YOU joined — not random internet targets')"
curl -sS -I --max-time 10 https://httpbin.org/ | head -10Primary tools to practice this lesson: curl, python3. Reference sites: Platform triage; Report quality. Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Private and hybrid programs
Private programs invite selected researchers — scope may be wider but access is gated. Hybrid programs split tiers: some assets pay bounties, others are VDP-only. Read which tier $SCOPE_HOST falls under.
Invite-only access does not expand to classmate deploy URLs or café sites — still one program, listed assets.
3. Program type does not expand scope
A generous bounty table for Asset A does not authorize Asset B. Program type describes rewards and access; scope lists hosts. Both live beside $SCOPE_HOST in your notes.
Ship: one-line label — which program type covers YOUR $SCOPE_HOST. Next: Picking Programs.
4. What you ship: program type label for $SCOPE_HOST
Label: public bounty / VDP / private / hybrid. $SCOPE_HOST named. No scope expansion. chmod 600.
5. What you record before the next lesson
Date. Program type for $SCOPE_HOST. File t20-m02-l02-program-types.txt chmod 600.
6. Wrong vs right: random sites vs in-scope program
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Assume VDP means 'scan anything on their brand.' Treat private invite as all-subdomain license.
Right
Label program type for YOUR $SCOPE_HOST. Next: Picking Programs.
Mission: classify YOUR program type
1) Label YOUR $SCOPE_HOST program type. 2) Note reward vs VDP-only if applicable. 3) Confirm type does not expand scope. 4) chmod 600. Never test unlisted assets.
Stuck? Ask Cyberlium AI Mentor
VDP ≠ no rules. VDPs still have scope and forbidden actions.
Knowledge Check
APPLY: A VDP typically:
Multiple choice
Knowledge Check
APPLY: True or False: Higher bounty tiers authorize testing unlisted production databases.
True or False
Knowledge Check
APPLY: Hybrid programs require you to:
Multiple choice