From P4 to P1: How I Earned My First Paid HackerOne Bounty

Validated, Not Just Lab Practice

Most aspiring security professionals train in labs. Labs are safe, deterministic, and quiet. Real programs are messy: hidden endpoints, legacy code paths, rate limits, and vendors who triage slowly. This is the story of my first $400 USD paid bounty on HackerOne - Report #3851049, awarded Jul 29, 2026 on the CLEAR program and paid via PayPal on Jul 30, 2026, earning the Bounty Hunter badge. It is verifiable on my public HackerOne profile.

The Severity Ladder: P4 to P1

On HackerOne's severity model, findings are triaged from P4 (informational/low) up to P1 (critical). My early submissions were honest but small - P4s and P3s that showed I understood the surface area but hadn't yet found the deep bugs. The breakthrough came from treating every low-severity finding as reconnaissance for the next one:

• P4 → P3: Configuration and exposure findings (missing headers, verbose errors) that map the attack surface.
• P3 → P2: Real, exploitable flaws - broken access control, IDOR, stored input issues - with clear business impact.
• P2 → P1 (in progress): Chaining smaller findings into account takeover or remote code execution paths.

The Winning Workflow

The paid finding came from a disciplined recon loop that I now apply to every program:

1. Enumerate the surface: subdomain discovery, JS bundle analysis, and API route mapping with Burp Suite and custom scripts.
2. Focus on state-changing flows: registration, password reset, email verification, and multi-tenant object access - where authorization bugs hide.
3. Test the business logic, not just the OWASP Top 10: parameter tampering, race conditions, and cross-tenant data access.
4. Write a triage-ready report: reproduction steps, impact assessment, CVSS scoring, and remediation guidance. A vendor-friendly report gets triaged and paid faster.

What the Payout Changed

The $400 is meaningful, but the payment mattered more: the program reviewed the report, awarded a bounty, and HackerOne paid it out - no dispute, no follow-up chase. That single event turned "bug bounty participant" into a researcher with a confirmed payout on record - the difference between listing an activity on a resume and proving it with a paid report reference.

Responsible Disclosure, Always

Every finding on this site was reported through the vendor's coordinated disclosure channel. I never test beyond scope, never access data I don't need, and never publish details before a fix ships. The goal is to make software safer - and a track record of clean, ethical disclosure is worth more than any bounty amount.

Next target: a P1 critical finding. The ladder only goes up.