A TEE is a hardware-isolated execution environment meant to keep even the machine's operator from seeing what runs inside; remote attestation lets an outsider verify which program is running in that room. WhatsApp's Private Processing uses it for AI summaries. Meta's bounty page lists code execution (including bypassing code attestation), privilege escalation and VM escape at up to $300,000 each, data leaks at $150,000 and persistence at $10,000, invitation only, with lower caps for internal-only scenarios. Trail of Bits' review found 28 issues, 8 of them high severity, which shows the hard part of TEEs is implementation detail, not the concept.
AI bounty pages mostly do not pay for what a model says (jailbreaks, hallucinations, harmful output). They pay when a model is made to act against someone else (actions and data theft through indirect prompt injection), and for ordinary bugs in the software around it. Google's AI VRP base rewards run from $100 to $20,000; OpenAI's Safety Bug Bounty ranges are $250 to $7,500 per report. Rules as read on 2026-10-14.
Google multiplies the reward by 0.8, 1 or 1.2 depending on report quality across seven dimensions, and only counts what you provided before triage; later additions usually do not change it. Write to a one-page template (title, summary, preconditions, steps, impact, fix suggestion), then estimate hourly expected value as probability x amount / hours. A bigger ceiling can still lose to a small payout once the odds are low enough. Every probability and hour count in this post is an assumption, not a statistic.
None of the three program pages I read (Google VRP, Meta, MSRC Hyper-V) asks for a certification; certifications matter for learning paths and job hunting, not for entry. This post marks each section of the site's four certification articles as useful or skippable for a bounty hunter, maps articles 1 to 11 of this series to free practice resources, then lists three first steps for each goal: job, curiosity, or bounty money.
All three numbers have an official source, but each drops a condition. Hyper-V's $250K needs a working exploit. Meta's $300K VM escape targets the confidential VM where WhatsApp Private Processing runs AI models; it pays for breaking that infrastructure, not for attacking the model, and is invitation-only. Google's $90K is an RCE on a standard *.google.com service with the top quality multiplier; the most sensitive tier starts at $101,010. A reward table gives a ceiling, not a success rate.
Ask three things of any program page: is the target on the in-scope list, is my technique excluded (DoS, social engineering), and is the data I touch my own? Safe harbor is the program's promise, not a free pass; Meta's text requires compliance 'in all respects', with a carve-out for clear accidental or good-faith violations, all judged by Meta. Taiwan's Criminal Code arts. 358-360 turn on acting 'without cause'. This is not legal advice.
A click turns a URL into an HTTP request, and the server answers with a status code. A cookie is the wristband the server hands you so stateless HTTP can recognize you. By the end you can find one request in DevTools' Network panel and point to its URL, method and cookie. The examples only hit your own machine.
XSS happens when a site puts user input into a page unchanged, so another person's browser runs it as code; the fix is escaping on output. IDOR happens when a server hands over whatever id it is asked for without checking the record is yours; the fix is an ownership check on the server. Google's table puts XSS under 'execute code on the client' (C0), $10,000 base on a standard Google app, and IDOR under logic flaws (S2), priced by how sensitive the exposed data is: on the same standard Google app, $3,133.7 to $31,337.
RCE means an outsider can make someone else's machine run code. In Google's table, for a normal *.google.com app, RCE has a $75,000 base reward against $10,000 for XSS. The two beginner paths are user input glued into a shell command and deserializing untrusted data; the fixes are argument lists and JSON.
Once a program is loaded into memory, the CPU runs it by following an address that says where it is now; each function call leaves a return address on the stack, a note saying where to go back to. A small C program that prints addresses lets you check this yourself.
A buffer overflow is data written past the space set aside for it, clobbering whatever sits next door. In the demo, one extra character in a name turns is_admin from 0 into 65; the fix is a length check plus a length-limited function. Canaries, ASLR and NX are extra layers, not guarantees, and AddressSanitizer catches an overflow of a standalone array but, in my test, missed one between fields of the same struct.
A hypervisor is the software layer between hardware and several operating systems that gives each virtual machine its own isolated execution environment. MSRC's Hyper-V bounty table splits guest escapes into L1 (up to $250,000) and L2 (up to $150,000); the difference is which wall gets crossed.
CVE-2021-28476 is a bug in Hyper-V's virtual network switch driver: a guest VM sends a crafted request, the host code follows an address inside it without checking, and the host crashes. Akamai claims two scenarios, a crash and code execution, but the public PoC only shows the crash; code execution was not publicly demonstrated. CVSS 9.9, patched May 2021. On the bounty table, what was publicly shown maps to the DoS cell (up to $15,000); the L1 guest-escape cell tops out at $250,000 and needs a working RCE exploit, but without an exploit that cell still has $200,000, $100,000 and $50,000 rows.