Milestone map
Milestone map
3 milestones
Train on legal labs and pick a program
3–4 weeks
Learn the common web vulnerabilities on legal practice labs. Then choose one public bug bounty program and read its scope and rules closely. Testing only what you're allowed to test is the first rule of this work.
Proof required
Submit your completed lab list (at least 15 labs across 5 vulnerability types) and a one-page summary of your chosen program's scope, exclusions and rules.
What gets checked
- Labs cover at least five vulnerability types
- Program scope and exclusions summarised accurately
- Rules on testing limits noted
Common mistakes
- Testing live sites before training
- Skipping the scope rules
- Picking a program far beyond your level
Powstik Guide
Lab practice and a clear read of one program's rules.
Steps
- Work through free web security labs by topic.
- Pick a public program with a wide scope.
- Copy its in-scope and out-of-scope lists.
- Note banned tests, like denial of service.
Template
Program: In scope: Out of scope: Banned test types: Rate limits: Reward table: Safe harbour terms:
What gets sent back
- Testing anything outside scope.
- Fewer than 15 labs.
- No scope summary.
Resources
Foundationstart here
Depthgo deeper
What a verifier looks for
- Check lab completion evidence
- Compare the scope summary to the program page
- Check out-of-scope items are listed
You'll sign in first, then come straight back here.
Submit well-written reports
3–6 weeks
Test in scope and submit at least three reports. Some may turn out duplicate or invalid. Write each with clear steps to reproduce and a real impact statement. Report quality is what gets triaged fast.
Proof required
Submit redacted copies of at least three reports and their triage outcomes, with any sensitive data removed.
What gets checked
- Clear reproduction steps in every report
- Impact stated honestly, not inflated
- All tests stayed in scope
Common mistakes
- Reports with no reproduction steps
- Inflated severity
- Sharing unredacted target data
Powstik Guide
Three clear, in-scope vulnerability reports.
Steps
- Confirm every target is in scope before testing.
- Record each step as you go.
- Write impact in plain terms.
- Redact data before sharing any report here.
Template
Report Title: Asset (in scope): Severity (your estimate): Steps to reproduce: 1. 2. Expected vs actual: Impact: Suggested fix:
What gets sent back
- Out-of-scope testing.
- No reproduction steps.
- Unredacted data.
Resources
Foundationstart here
Depthgo deeper
What a verifier looks for
- Check redaction
- Check steps are reproducible as written
- Check scope compliance
You'll sign in first, then come straight back here.
Earn a $500+ valid bounty
1–6 months
Find and report a valid vulnerability that earns $500 or more. Follow the program's disclosure rules to the letter. The payout confirms a real flaw that the owner agreed was serious.
Proof required
Submit the platform's resolved-report and payout confirmation (redacted as needed) showing $500+ and your profile link.
What gets checked
- Payout of $500+ from a public program
- Report marked resolved or triaged valid
- Disclosure rules followed
Common mistakes
- Disclosing before the program allows
- Counting points instead of money
- A private or invented program
Powstik Guide
A valid, paid vulnerability report.
Steps
- Focus on one asset type you know well.
- Keep testing within scope and rate limits.
- Report as soon as you confirm impact.
- Wait for permission before any public write-up.
Template
Proof checklist [ ] Program is public [ ] Report status: resolved / triaged [ ] Payout amount: $___ [ ] Profile link [ ] Disclosure permission (if writing up)
What gets sent back
- Payout under $500.
- Early disclosure.
- No payout record.
Resources
Foundationstart here
Depthgo deeper
What a verifier looks for
- Check the payout record
- Check the program is public
- Check disclosure timing
You'll sign in first, then come straight back here.