Bounty programs are all the rage these days but what do hackers / researchers think of them? Drawing on my experience as a participant in multiple bounty programs I want to discuss the ins and outs of how hackers work with companies, what they are looking for (hint: not just money) and how companies can improve their programs to attract more researchers.