Bug bounties are older than most people think. Netscape launched one for the Navigator 2.0 beta in 1995, but Wikipedia's article lists earlier examples, including a 1983 offer of a Volkswagen Beetle. Hack the Pentagon, announced in March 2016, was the US federal government's first bug bounty program.
A timeline
Taken from the Wikipedia article on bug bounty programs:
- 1851. Alfred Charles Hobbs was paid the equivalent of US$20,000 (inflation adjusted) to pick a lock.
- 1983. Hunter and Ready advertised with the line "Get a bug if you find a bug," offering a Volkswagen Beetle to hackers who found bugs in its VRTX operating system.
- 1995. Netscape launched a bounty for the beta of Netscape Navigator 2.0.
- March 2016. Peter Cook announced Hack the Pentagon, the first US federal government bug bounty program.
- 2019. The European Commission announced the EU-FOSSA 2 bounty initiative for popular open source projects, which resulted in 195 unique and valid vulnerabilities.
- 2025. The Czech Republic's government launched its official bug bounty program.
Note that the article does not call Netscape the first. If a source says so, treat it with care.
What changed over time
Early programs were run by one company for one product. Later, crowdsourcing platforms made it easier for researchers to find programs and for companies to run them. Governments joined, and public funders started paying for flaws in open source software they rely on.
What bounties are good for
- They widen the pool of people looking at your system.
- They give outsiders a legitimate path to report.
- They put a price on a class of bugs, which shapes what researchers choose to hunt.
What they are not
A bounty does not replace testing, code review or secure design. It finds what outsiders can reach, and only what they choose to look at.
The Wikipedia page on responsible disclosure adds that some researchers see payment demands as a point of friction, and some view them as extortion. A clear policy that states scope and safe harbour reduces that friction.
If you are thinking of starting a program, begin with a plain vulnerability disclosure policy. Add rewards later, once you can triage reports quickly.
Choosing between a policy and a bounty
A disclosure policy tells outsiders how to report and what you will do. A bounty adds money. Many organisations should start with the first. It costs little, and it shows whether you can handle the volume and quality of incoming reports. If reports are slow to triage today, paying for more will make that worse. Add a bounty when you can acknowledge a report within days, reproduce it, and fix serious issues on a predictable schedule. Start with a narrow scope, a few key systems, and widen it as the process proves itself.
Quick check
Was Netscape's 1995 program the first bug bounty?
The source cited below lists earlier examples, from 1851 and 1983, so it does not call it the first.
What was EU-FOSSA 2?
A 2019 European Commission bug bounty initiative for popular open source projects that produced 195 valid vulnerabilities.
Safeguard offers dependency scanning that helps open source maintainers and consumers see known flaws, and a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
