You can reward researchers without paying cash. The OWASP cheat sheet names discounts, swag and a hall of fame listing as options. What researchers value most is a fast reply, honest communication and accurate credit. Start there, then add recognition you can sustain.
Credit is the baseline
Name the researcher in the advisory unless they ask not to be named. Agree the exact wording first: a name, a handle, a company, a link. Some researchers prefer anonymity. Respect that, and ask rather than assume.
An acknowledgments page
security.txt has an optional Acknowledgments field that links to a page recognizing researchers, per RFC 9116, and the field can be repeated. Publishing a page and linking it from the file tells researchers you notice their work.
Keep the page simple: name, date, a one line description of the class of issue. Do not publish technical details that are not in an advisory yet.
Other low cost gestures
- A personal thank you from an engineer who fixed the bug.
- Swag or a discount on your product.
- An offer to let them retest the fix before release.
- A reference letter or a note on their profile if they ask.
- A preview of the advisory so they can check the wording.
OWASP specifically recommends offering researchers a chance to retest fixes and confirming when an issue is resolved.
What not to do
Do not promise a reward you cannot deliver. Do not call something a bounty when it is a gift. Do not hold credit hostage to the researcher agreeing to silence. And do not publish a researcher's name without agreement.
Keep it fair
Decide in advance what earns recognition: valid, in scope, first report of an issue. Applying that rule consistently is more important than its exact wording. If you later start paying, pay earlier reporters retroactively only if you said you would.
When to move to cash
If reports are frequent and the best ones come from a small group of people, consider a program with rewards. Use the readiness checklist first, and see VDP or bug bounty for the decision.
Quick check
Is a thank you email enough?
It is a good start, especially when it is prompt and specific. Pair it with credit in the advisory.
Should we publish researchers' names by default?
Ask first. Some prefer anonymity or a handle.
Sources
Last reviewed: 19 October 2026.
