AI Bug Bounty: Scope, Fairness & Incentive Evaluation

Welcome! This brief survey collects your feedback on fairness, scope clarity, and incentive design in our AI bug bounty program over the past 6 months. Your responses are confidential and will be reported in aggregate only. There are no right or wrong answers—we value your honest perspective. The survey takes approximately 8–10 minutes. Participation is voluntary, and you may stop at any time.

In what ways are you involved with the AI bug bounty program? (Select all that apply.)

• Program owner/manager
• Security/AppSec
• Engineering/Platform
• AI/ML
• Legal/Compliance
• Trust & Safety
• Procurement/Vendor management
• Product/UX
• Executive sponsor
• Not directly involved but aware of the program

How long have you been involved with or aware of the AI bug bounty program?

• Less than 3 months
• 3–6 months
• 6–12 months
• 1–2 years
• Over 2 years

How clear are the program's overall objectives to you today?

How clear is the definition of which AI/ML assets and models are in scope?

How clear is the definition of which vulnerability types and AI-specific attack vectors qualify?

How clear are the severity classification criteria and corresponding payout tiers?

How clear are the out-of-scope exclusions and rules of engagement?

If any scope wording feels ambiguous or incomplete, please share specific examples or phrases you would improve.

Thinking about the last 6 months, how fair overall have our bounty decisions been?

How consistent have severity classifications been across similar submissions?

How fair have payout amounts been relative to the effort and impact of submissions?

How timely and communicative has the triage process been?

How fairly have duplicate or disputed reports been handled?

How adequate are current payout amounts relative to the effort and impact of submissions?

Which incentives most motivate high-quality submissions? (Select up to 3.)

• Cash bounties
• Public recognition/leaderboard
• Private recognition (internal kudos)
• Swag/merchandise
• Invitation-only access or beta programs
• Faster coordinated disclosure timelines
• Access to datasets/APIs/sandboxes
• Higher severity multipliers/bonuses
• Charity donation option

Which changes would most improve fairness and clarity in the program? (Select up to 3.)

• Publish clearer severity examples
• Share payout ranges by severity
• Standardize triage SLAs
• Provide a scope decision tree
• Add public case studies
• Introduce independent review for disputes
• Expand test environment access
• Increase frequency of scope updates

Please rank the following success metrics from most to least important for evaluating the program.

1. Number of valid reports
2. Reduction in repeat issues
3. Time to triage
4. Time to fix
5. Researcher satisfaction
6. Severity-weighted impact
7. Coverage across AI components

How likely are you to recommend our AI bug bounty program to an external security researcher?

We'd like to explore your feedback in more depth. An AI moderator will ask you a couple of follow-up questions based on your earlier responses about the bug bounty program.

Based on your responses in this survey, please share any additional thoughts or suggestions for improving the AI bug bounty program.

How long have you worked at this company?

• Less than 6 months
• 6–12 months
• 1–3 years
• 3–5 years
• Over 5 years
• Prefer not to say

Which region do you primarily work in?

• North America
• Latin America
• Europe
• Middle East
• Africa
• South Asia
• East Asia
• Southeast Asia
• Oceania
• Prefer not to say

Approximately how many bounty reports have you personally reviewed in the last 6 months?

• 0
• 1–5
• 6–20
• 21–50
• 51+
• Not applicable

Thank you for completing this survey. Your feedback will directly inform improvements to scope clarity, evaluation fairness, and incentive design in the AI bug bounty program.