[collingreene]

+1 to starting a private program first which is recommended by all bounty programs.

If helpful I wrote down my notes about starting a bounty program although my experiences were formed by larger companies https://medium.com/@collingreene/bug-bounty-5-years-in-c95cd...