How a bounty table works

A bounty table lists a minimum and a maximum for each severity band. The calculator does not invent a second table. It reads the numbers you enter, then applies a small set of factors, so one finding becomes one dollar figure.

The asset class changes the range first. A core asset keeps the full minimum and maximum. A secondary asset uses half of each number. A peripheral asset uses a quarter. After that, the calculator takes the geometric mean of the adjusted minimum and the adjusted maximum. That mean sits inside a wide range instead of hugging the floor. If you mark a working proof of concept, the calculator adds 25 percent to that mean. It then rounds to the nearest $50 and keeps the result inside the adjusted range.

On the starting table, a critical finding on a core asset runs from $5,000 to $15,000. The geometric mean is about $8,660, which rounds to $8,650. That is the example on the Bug Bounty Calculator. If the same finding sits on a secondary asset, the range becomes $2,500 to $7,500 before the mean is taken.

The starting dollars are not an industry average pulled from other programs. They are a typical public-program order of magnitude, so the fields are not empty. Replace them with the amounts your policy pays. If your table is a single number per severity, enter that number as both the minimum and the maximum. The mean then equals that number, and only the asset factor and the proof-of-concept bonus still change the result.