Table of Content:

Why am I writing this?

It’s been 12 months i.e. 52 weeks (July 2023 to June 2024) in into bug bounties. I’m writing this to review all these 12 months in a go, no filters. I’ll share my raw stats, graphs and learning for all these 12 months. This is going to be personal, written for my own self. I have no intention to make it fancy but gonna make it public so that people like me who might be there in my situation learn something from this. Again, I have no intention to make it seem helpful - if it’s helpful, it’s helpful, if not, who cares.

It’s gonna be overwhelmingly dense.

🌟 The Review (July 2023 to June 2024)

As I said in my 8 month roadmap post, which was kind of a 9 month post - I didn’t count July mostly coz the July data was a lot skewed coz I spent most of it learning or doing random things, but I feel that should not be an excuse to not count that in. I tried cleaning the data a little, so ig it’ll be close to appropriate now. Hence also considering July in this review, hence the review: July 2023 to June 2024.

⌛ Time Audit

FAQ:

• Which time tracking tool?
  • https://clockify.me/
• Tables? how?
  • Notion database
• Graphs?
  • Clockify
  • Google sheets

• Semi-Annual Time Audit:

  Time Span	Time Spent	Days Worked	Bugs Reported	Info	Dupe	No Response	Valid	Paid	Pending	Bounties (USD)	Pending Bountes	Total Bounties (with pending)
  July 2023 to Dec 2023	398 hr 53 min	106/184 days	58	28	5	2	23	11	0	$1,250	0	$1,250
  Jan 2024 to June 2024	322 hr 55 min	79/182 days	50	15	14	6	11	6	4	$14,950	$1200 (min) - $9,500 (max)	$16,150 (min) - $24,450 (max)
  Total	721 hr 45 min	185/366 days	108	43	19	8	34	17	4	$16,200	-	$17,350 (min) - $25,700 (max)

  Observations/Learning:

  • The number of Info I was getting has almost been zeroed.
  • No response zeroed completely too, I learnt to choose good programs.
  • Bounty average per month from initial 6 months to final 6 months has increased from ~$200/month to ~$2500/month
  • Number of days worked decreased from 106 to 79, whereas it was expected to increase. Wedding season hurts expected results.
  • Number of hours worked was supposed to go up and end up somewhere around 600 hrs, I did put in half the efforts I wanted to put in otherwise.

  Timeline:

  • July 2023 to Dec 2023:
    • First 6 months were very emotionally hard, extreme imposter syndrome, difficult, burn outs. Couldn’t touch bug bounties for weeks, major focus was on recon, automation, switching programs
    • Nothing was happening the way I expected, like everywhere I imagined best case scenario - worst case scenario happened. This helped me build right emotional mindset though.
    • Almost 275-300 hrs out of those 398 hrs were spent in automation & recon, as much as I remember, I rarely hunted manually and if I did I quickly switched programs within hours. I got a few really good bugs hunting manually though whenever I did.
    • I also had no idea how to test website, I used to go blank. Never spent more time inside burp actually reading proxy history and requests. Most of my hunting was just recon, no hacking.
  • Jan 2024 to June 2024:
    • Was reporting a lot of informative initially, was not taking my bugs to extreme and had no idea what impact I was creating. Was literally reporting anything I could find thinking that they’ll analyze impact on their own.
    • Then in Jan 2024, I read 5000 H1 reports and realized what kinda impact they expect. Informative almost turned zero after this. The only informative I got after this was because of a silly mistake I did - reported a false positive.
    • I started approaching my targets manually, ditched recon completely and started hunting on main web application.
    • Started seeing results immediately.
    • Wedding season started, couldn’t focus on bug bounties as much in the last 3 months.

  Graphically:

  

  July 2023 - Dec 2023

  

  Jan 2024 - June 2024

  ---

  Explanation on pending bounties stats; why do I do min-max?: even though the triaged severity is known & we know what bounty to expect, I like to expect the least or none at all so that it won’t affect my emotional state in any ways. If I expect the least, anything less worse will feel way better. I’m not sure if it’s just me but both emotional lows and emotional highs affects my performance a lot and the efforts I put in dips significantly, hence I try to neutralize my emotions as much as possible by always expecting the worse case scenario no matter what.

  ---

Zooming In!

• Quarterly Time Audit (3-months span):

  Time Span	Time Spent	Days Worked	Bugs Reported	Info	Dupe	No Response	Self closed or NA	Valid	Paid	Pending bounty	Bounties (USD)	Pending Bounties (min-max)	Total Bounties (with pending)
  July - Sept 2023	243 hr 11 min	58/91	32	14	4	0	0	14	4	0	$500	0	$500
  Oct - Dec 2023	155 hr 41 min	48/91	26	14	1	2	0	9	7	0	$750	0	$750
  Jan - Mar 2024	220 hr 59 min	48/90	42	14	13	6	1	6	5	0	$14,350	0	$14,350
  Apr - June 2024	101 hr 53 min	31/90	8	1	1	0	1	5	1	4	$600	$1200 (min) - $9,500 (max)	$1600 (min) - $10,100 (max)
  Total	721 hr 45 min	185 /366	108	43	19	8	2	34	17	4	$16,200	-	$17,350 (min) - $25,700 (max)

  

  July 2023 - Sept 2023

  

  Oct 2023 - Dec 2023

  

  Jan 2024 - March 2024

  

  April 2024 - June 2024

• Quarterly Time Audit (4-months span):

  Time Span	Time Spent	Days Worked	Bugs Reported	Info	Dupe	No Response	Self closed or NA	Valid	Paid	Pending bounty	Bounties (USD)	Pending Bounties (min-max)	Total Bounties (with pending)
  July 2023 - Oct 2023	302 hr 32 min	75/123	40	19	4	0	0	17	6	0	$700	0	$700
  Nov 2023 - Feb 2024	262 hr 26 min	66/121	48	22	9	8	1	9	7	0	$1400	0	$1400
  Mar 2024 -June 2024	156 hr 45 min	44/122	17	2	6	0	1	9	4	4	$14,100	$1200 (min) - $9,500 (max)	$15,300 (min) - $23,600 (max)
  Total	721 hr 45 min	185 /366	108	43	19	8	2	34	17	4	$16,200	-	$17,350 (min) - $25,700 (max)

Note: These many variations only to observe patterns so that I could understand what exactly I need to do to bring change and improve upon.

Observations/Learning: