This is an excellent point, but there&#x27;s a good answer to it.<p>The purpose of a bug bounty is <i>not</i> to encourage a particular individual to report an issue rather than sell it. The purpose is to encourage <i>more</i> people to get into the business of finding and reporting bugs <i>before</i> the people who are in the business of selling bugs to criminals find them and sell them. If, in the process, some black hat researcher <i>also</i> decides to report some particular bug rather than facilitate a crime, so much the better - but you can&#x27;t rely on that, and you shouldn&#x27;t design a bug bounty program around it.<p>In other words, you&#x27;re not <i>competing</i> with the black market. Instead, you&#x27;re <i>paying</i> to improve your security, and accordingly, you want to get the most bang for your buck. Finding previously-unknown entry points is high-value. Finding internal pivots is extremely <i>low-value</i> because they are ubiquitous, and your infrastructure is already designed around the assumption that they are ubiquitous.<p>Which isn&#x27;t to say that you aren&#x27;t interested in finding the internal vulnerabilities and eliminating them. You are. Which is why you conduct penetration tests. But pen tests are big deals, with rules of engagement around them. You deliberately give the testers elevated internal access so they can test under the assumption that there may be an entry point you don&#x27;t know about. You establish ongoing communication between the testers and the clients, especially at any potential pivot or escalation point prior to proceeding. You don&#x27;t run a pen test by opening it up to anyone who wants to give it a whack and hoping that they&#x27;ll tell you about it afterwards (i.e. a bug bounty program). That&#x27;s an insanely high-risk, low-value way to discover your internal vulnerabilities.