Beg bounty

A beg bounty is an e-mail that reports a trivial finding, such as a missing HTTP header or DMARC record, as a vulnerability and asks for a reward. The name is a play on the bug bounty, a genuine reward programme, and on the verb "to beg".

Definition in the Regulation

Regulation (EU) 2024/2847 does not use the term. It requires a contact address for reporting vulnerabilities (Annex I, Part II, point (6)) and, in recital 76, allows bug bounty programmes without requiring them. Section 4.4.5 of BSI TR-03183-3 provides that the manufacturer publishes what it regards as a valid vulnerability; in doing so, it may exclude results of automated tools or scans without supporting documentation. Most beg bounty e-mails fall squarely into that category.

What it means for manufacturers

Anyone who publishes a reporting address receives e-mails like these, often sent to several addresses at once and written from a template. What works is a policy that states there is no reward and what counts as a vulnerability, plus a single polite reply from a standard text. Deleting them unread is not a good idea: a badly worded e-mail can hide a genuine report, and the TR requires that no report is closed by a single person (section 4.4.7). If a sender threatens publication or an attack after being turned down, do not negotiate.

Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit

Related terms

• security.txt
• Coordinated vulnerability disclosure (CVD)
• Vulnerability notification (72-hour notification)
• PSIRT

Learn more

• Spam in the security mailbox: handling beg bounties, scanner reports and bulk mailWhat arrives, and how manufacturers classify and respond without losing a genuine report.
• Spam since publishing security.txtHow CRA Response Center separates beg bounties from genuine reports.