guides
bug bounty program, good intentions, hacking is not a crime, port scanning is not a crime,  vulnerability

This article is more of a thought piece than a technical guide. It’s a collection of my reflections, and while you might not agree with everything, I’d love to hear your thoughts. Maybe you’ll help me refine my perspective on the subject.

At first glance, reporting a vulnerability seems straightforward. You find a bug, report it to the service owner, they fix it, and you get a thank you—maybe even a reward. In a perfect world, this is how it works. But in reality, things can go sideways fast. Instead of being hailed as a hero, you might find the police at your door, ready to arrest you for "unauthorized access."

Sounds dramatic, right? But it happens. You report a bug in good faith, only to be labeled as the "bad hacker" and face legal consequences. Why? Because you were poking around where you "shouldn’t have been."

I’m writing this because I’ve seen too many well-meaning individuals turn from heroes to villains overnight. And honestly, it’s made me second-guess reporting vulnerabilities myself. I shouldn’t have to worry about legal repercussions when I’m trying to help, but the reality is, the law doesn’t always see it that way.

To the average person, a hacker is a hacker—no distinction between white hats, black hats, or security researchers. Hacker = bad guy. And that’s frustrating.

The law is slow to adapt to technology. While some countries have cybersecurity-savvy lawyers, they’re not the norm. Most legal systems struggle to understand concepts like penetration testing, blockchain, or even basic port scanning. If the law doesn’t understand the technology, how can it protect those who use it ethically?

Intent matters, but without clear regulations, even good intentions can land you in hot water.

Big companies with bug bounty programs are one thing, but smaller organizations or government entities? They often see vulnerability reports as a nuisance, not a help.

In my opinion, investing in bug bounty programs is a no-brainer. It’s cheaper than dealing with a data breach or losing customer trust. But not everyone sees it that way.

The safest route is to stick to bug bounty programs. These programs have clear rules and scopes, so you know exactly what’s allowed. If you’re unsure whether a company has a program, check their website or reach out to them directly. A quick, professional response usually means they’re open to collaboration.

Here’s a list of popular bug bounty platforms:

For a comprehensive list, check out:
https://www.vulnerability-lab.com/list-of-bug-bounty-programs.php

But what if the company doesn’t have a bug bounty program? That’s where things get tricky.

A while back, I found a vulnerability in a public transport card system. I won’t go into technical details (the case is still ongoing), but let’s just say it was a glaring security flaw. I knew reporting it directly would likely backfire—especially in a country where cybersecurity isn’t exactly a priority.

Instead, I reached out to a local security company. They took the information, verified it, and reported it to the transport company on my behalf. It took six months, but eventually, the vulnerability was patched.

The lesson? Sometimes, it’s better to let a third party handle the report.

When you’re hunting for bugs, it’s crucial to separate your personal environment from your testing environment. I use a VPS (Virtual Private Server) with a landing page that explains the server’s purpose. This way, if my IP gets flagged, there’s context.

Here’s what my setup looks like:

Why go through all this trouble? Because you don’t want your home IP associated with scanning activities. Trust me, solving CAPTCHAs every time you browse gets old fast.

Here are some key takeaways from my research:

Reporting vulnerabilities shouldn’t be a legal minefield. But until the law catches up with technology, we need to be careful. Stick to bug bounty programs, document everything, and when in doubt, consult a legal expert.

And remember: hacking isn’t a crime. It’s a skill. Use it wisely.

If you found this article helpful, check out my other guides on ethical hacking. And if you have any thoughts or experiences to share, drop me a line—I’d love to hear from you. Motivate me by subscribing us on Youtube