🌏 中文版
This is the last article in "Bug Bounty from Zero". The first eleven covered rules, how websites work, common bugs, memory, virtual machines, and reports and expected value. This one answers two closing questions: if you want to hunt bugs, should you get a certification? And after this series, where can you keep practicing each part?
The site already has a four-part series on security certifications: the landscape map, the AI security cert showdown, the ROI breakdown of three classic certs, and the Taiwan certification ecosystem. (The four are written in Chinese; English versions exist for each.) This post does not redo their comparisons, and it does not repeat fees, exam formats or validity periods, because those change. For those, trust the site articles and each certification's own website. What this post does is read those four articles from a bounty hunter's seat and tell you which parts to read and which to skip.
The short answer first. None of the three bounty pages I read requires a certification. Certifications connect to bug bounty through learning paths and job hunting, not through who is allowed to submit a report.
Do bounty programs ask for a certification? Three pages, read in full
On 2026-10-14 I read each page in full and looked at what it asks of you:
| Page | Eligibility conditions I found | Certification required? |
|---|---|---|
| Google and Alphabet VRP Rules | Target in scope, a technical vulnerability, test only your own accounts; participants must be 18 or older, and under-18s should have a parent or guardian submit for them; no rewards for people or territories on sanctions lists | No |
| Meta Bug Bounty scope page | Follow the responsible research and disclosure policy, report an in-scope security bug, submit through the form, use test accounts when testing | No |
| Microsoft Hyper-V Bounty (MSRC) | Critical or Important severity, state the impact, state the attack vector if not obvious; the page also "requests" that researchers submit through the MSRC Researcher Portal (worded as a request, not as an eligibility condition) | No |
Here is how far that claim goes: it covers only "the three pages I read." The MSRC page links to a general Bounty Program Guidelines document, and Meta has a separate terms page. I did not read either this time, so I am not claiming that every Microsoft or Meta document is free of certification requirements. Before you submit anything, read the rules of the specific program you are testing. That is what article 1 is about.
What the three pages have in common is that they judge reports, not people: scope, reproduction steps, impact. Google's rules page even breaks report quality into several dimensions and adjusts the reward by a multiplier (0.8x, 1x or 1.2x). I connect that to article 11 below.
What the site's four certification articles are answering
Before using those four articles, know who they were written for. The "security certification" series targets software developers who are not security specialists and who build AI platforms. Its suggested route has three phases: Security+ and AWS Security together for security basics and cloud, then an AI security certification, and finally CISSP as the long-term credential.
That target creates one difference worth spelling out. The "What to skip (for now)" table in the landscape map lists OSCP (OffSec's penetration-testing certification), with the reason that it is "Excellent but too offense-focused for the goal of building a secure AI platform." The same article describes its "Offensive security" category in one line: "Red team, penetration testing, bug hunting." These do not contradict each other: the same certification is a detour for someone building a secure platform and the main road for someone going offensive. I am not rewriting that article's conclusion. I am only asking you to swap the word "for now" for your own goal when you read that table.
As for what OSCP actually is, I read OffSec's OSCP+ exam guide (checked 2026-10-14). It says the certification validates hands-on ethical hacking and penetration testing skills; the exam is a simulated network inside a private VPN with a small number of vulnerable machines; the credential is awarded "without prerequisites"; and you must submit a professional penetration test report. The next point is my own judgment, not OffSec's: the exam targets exist to be attacked, while a bug bounty target is a live service, which is why you must read the scope first. For fees, hours and validity, see the site article section and OffSec's website.
The table below marks each of the four articles as "worth reading" or "skippable" for a bounty hunter. The labels are my judgment.
| Site article | Worth reading | Skippable |
|---|---|---|
| Landscape map | The Foundational and Offensive security categories inside "Six tracks — figure out which one you're on," the "Free starting points" section, and the logic of the three-phase decision tree | Cloud security, management and governance, per-phase cost estimates (written for a different reader) |
| AI security cert showdown | The "benchmark" section (using the OWASP Top 10 for LLM Applications as the yardstick) and, in the offensive section, COASP, OSAI+ and HTB COAE if you want to test AI products; GIAC GOAA is about using AI as an attack tool, and that article says it is the wrong fit for testing your own LLM application, so skip it | The item-by-item comparison of four AI security certifications (defense and governance oriented) |
| ROI breakdown of three classic certs | How it counts "preparation time" and "maintenance cost": add up your total spend before registering | Salary premiums and ROI multiples (they measure the job market, not bounty income) |
| Taiwan certification ecosystem | The part saying "The real push comes from the job market." (it shows how to read job postings), the section on Taiwan's local certification, and the offense-oriented courses in the training-provider comparison | The Cybersecurity Management Act, the FSC staffing tiers, the financial-sector mandatory training (corporate compliance duties, not the legal line for an individual tester) |
The benchmark section has one real connection to bounty work. Meta's scope page says its program is interested in "integral privacy or security issues associated with Meta's large language models," such as leaking or extracting training data through model inversion or extraction attacks. If you want to test AI products, treat that section as a vocabulary list. Google's rules page lists AI programs separately as the AI Vulnerability Reward Program Rules; I only saw the name and did not read its contents.
Articles 1 to 11: site cross-references and free practice
In the table below, "free practice" lists only resources whose official pages I read on 2026-10-14. "Free" rests on what each page says about itself; check the website for current terms. The "matching section in the site's cert articles" column is my own mapping, not something those four articles state. "None" means the site's certification articles have no matching section, and I did not stretch one to fit.
| This series | What it teaches | Matching section in the site's cert articles | Free practice outside the site |
|---|---|---|---|
| Article 0: top payouts fact-checked | What conditions sit behind the maximum amounts on bounty tables | None | Read the payout pages directly: Google, Meta, MSRC |
| Article 1: rules and scope | Whether you may test a target; the limits of safe harbor | The "regulation" part of the Taiwan ecosystem article covers only corporate duties and is a different subject; skip it | The three program pages themselves; the WebGoat project page says never to look for vulnerabilities without permission, and that it binds to localhost by default |
| Article 2: how websites work | URLs, HTTP, cookies | None | PortSwigger Web Security Academy (the home page has a Get started entry I did not read page by page) |
| Article 3: XSS and IDOR | Two common web bug classes and their fixes | The "application security" category in the landscape map is about writing secure code, the fixing side | PortSwigger's XSS and Access control topics; OWASP Juice Shop |
| Article 4: RCE | Command injection and insecure deserialization | The "Offensive security" category in the landscape map | PortSwigger's OS command injection and Insecure deserialization topics |
| Article 5: how programs use memory | Stack, heap, return address | None | The Computing 101 dojo on pwn.college (starts from machine code; modules include Computer Memory and The Stack); the Program Security dojo |
| Article 6: buffer overflow | Why overflows are dangerous and how to fix them | None | Same as above; the dojo's module names include Return Oriented Programming and Dynamic Allocator Misuse, but I only saw the module names and did not open each one |
| Article 7: VMs and hypervisors | The wall between guest and host | None. The cloud security category in the site articles is about how people who use the cloud configure IAM, KMS and VPCs, a different layer from the hypervisor itself | Read the L1 and L2 payout table on the MSRC Hyper-V page. I could not verify a beginner-friendly free hands-on hypervisor lab |
| Article 8: a Hyper-V escape case study | Reading the public analysis of a patched bug | None | Same as article 7; the exercise is read-only: redraw the public analysis yourself |
| Article 9: TEE and confidential computing | Hardware-isolated execution environments and the matching rows on Meta's payout page | None | I did not verify any public practice environment; Meta's scope page says WhatsApp Private Processing is by invitation only |
| Article 10: bounties for AI products | What each vendor's AI bounty page accepts and rejects | The "benchmark" section and the offensive certifications in the AI security cert showdown (except GOAA) | PortSwigger's home page lists a Web LLM attacks topic. Reading material, not a practice environment: the risk list in the OWASP Top 10 for LLM Applications |
| Article 11: reports and expected value | How to write a report and estimate expected value | The ROI article's habit of counting your spend up front is a fair analogy, but its numbers measure certifications, not bounties | The "Report quality" table on Google's rules page; the OSCP+ exam guide also requires a report, which is another model of report writing |
The Linux Luminarium dojo on pwn.college is an introduction to the Linux command line and does not map to any one article in this series; if the terminal is still unfamiliar, start there before the local examples.
Meta also runs a public Education Center with research articles and per-app resources for WhatsApp, Facebook, Messenger and Instagram. It is worth a look if you plan to test services in Meta's scope.
Two practical notes. First, the pwn.college home page says the platform is open, for free, to interested people around the world, and also asks learners not to post write-ups, walkthrough videos or livestreams of challenge solutions, because the same challenges are used to grade university courses. Keeping private notes is fine; publishing solutions is not. Second, practice only on your own machine or on targets that explicitly authorize you, which is the baseline from article 1.
Different goals, different first steps
Every cell in the table below is the author's suggestion, not any organization's rule.
| Your goal | Suggested first step (author's suggestion) | Matching articles in this series | Matching site cert articles |
|---|---|---|---|
| A job in security | Find three postings you want and copy down the certifications and skills they ask for | Articles 1, 2, 3 as groundwork | The "job market" part of the Taiwan ecosystem article; the Foundational and Offensive security categories in the landscape map |
| Curiosity (how hackers think) | Run the local examples in articles 2 and 3 first; do not register for any exam | Articles 2 to 6 | None. The landscape map's "Free starting points" are almost all exam-prep resources for Security+, AWS and CISSP, which you will not need if you skip the exams |
| Bounty money | Read the full rules page of the program you want to test | Articles 1, 3, 11 | None required; the ROI article is useful for its way of counting costs |
| A developer who wants safer code | Go back to the cert series' original route | Articles 3, 4, 6 for the fixes | The landscape map's decision tree; its conclusion stands |
Job: three things to do first
- Open three postings you would want and copy the certifications and skills they list. The Taiwan ecosystem article demonstrates this using a bank's posting on 104.
- Finish the exercises in articles 1 to 3, then pick one topic on the PortSwigger Academy, finish its labs, and write up what you did in your own words.
- Read the Foundational and Offensive security sections of the landscape map, then the preparation-time and maintenance-cost parts of the ROI article, and decide whether to take one. Check the official site for current details before registering.
Curiosity: three things to do first
- Follow article 2 and use curl against a service on your own machine; find your own request in the browser's developer tools.
- Run Juice Shop or WebGoat on your own computer, solve one challenge in each, and note where you got stuck.
- Compile the C programs from articles 5 and 6, then open one module in pwn.college's Program Security dojo. None of this needs a certification or any money.
Bounty money: three things to do first
- Read article 1, then read the full rules page of the program you plan to test, and confirm your target is in scope and your technique is not excluded.
- Do the Access control and XSS labs on PortSwigger and compare them with the two bug classes in article 3.
- Read article 11, estimate your expected value first, and only then decide how much time to put in. A certification does not make the top three on this road.
Limits
- The four site certification articles were published on 2026-09-10 and updated on 2026-10-12. Certification rules, prices and exam formats change, so the official website always wins.
- On certifications I read only OffSec's OSCP+ exam guide, not the official pages of any other certification, so this post makes no new claims about them.
- That the three bounty pages carry no certification requirement is what I read on 2026-10-14. Program rules change; reread before you submit.
- For outside resources I confirmed that the page exists and describes itself as free. I did not finish every lab myself and did not check how hard each one is.
- For hypervisors (articles 7 and 8) I could not verify a beginner-friendly free hands-on platform, so the table lists only what I verified.
References
- Google and Alphabet Vulnerability Reward Program (VRP) Rules (read 2026-10-14)
- Meta Bug Bounty: Program scope (read 2026-10-14)
- Meta Bug Bounty Education Center (read 2026-10-14)
- Microsoft Hyper-V Bounty Program (MSRC) (read 2026-10-14)
- OffSec: OSCP+ Exam Guide (read 2026-10-14)
- PortSwigger Web Security Academy (home page read 2026-10-14)
- OWASP Juice Shop (read 2026-10-14)
- OWASP WebGoat (read 2026-10-14)
- OWASP Top 10 for Large Language Model Applications (read 2026-10-14)
- pwn.college home page (read 2026-10-14; source for free access and the request not to post solutions)
- pwn.college: Dojos overview (read 2026-10-14)
- pwn.college: Computing 101 dojo (read 2026-10-14)
- pwn.college: Linux Luminarium dojo (read 2026-10-14)
- pwn.college: Program Security dojo (read 2026-10-14)
- On this site: Security certification landscape map, AI security cert showdown, ROI breakdown of three classic certs, Taiwan security certification ecosystem
- In this series: Article 0, Article 1, Article 11
Loading...