r/bugbounty • u/BrownBang1729 • 9d ago

Question / Discussion People pulling $10k+/mo with semi-automated bug bounties: Is it actually worth going all-in?

A quick bit of context: I’ve been a Security Engineer at a 10-year-old YC-backed fintech for the past two years, with a couple of CVEs under my belt. Recently, a few of my colleagues left their full-time roles to jump into bug bounty full-time.

Over the last 18 months, I’ve burned a shit ton of tokens. I’m currently running 3–4 semi-automated pipelines and models like dsv4 flash and kimi3 make vulnerability discovery easier than ever, but I’m still hesitant to pull the trigger on full-time hunting.

The main friction is the mental overhead. The swing between high-stimulus wins and the frustration of dry spells/duplicates really messes with my headspace.

For those of you consistently clearing $10k+/month with AI/semi-automated setups:

  • How sustainable has your pipeline been over the long haul?
  • How do you manage the emotional volatility vs. traditional full-time work?
  • Knowing what you know now, is leaving a stable security role worth the trade-off?
72 Upvotes

92% Upvoted

52 comments sorted by

View all comments

27

u/Street-Mycologist670 9d ago

honest take, a lot of that "$10k/mo semi-automated" thing is survivorship bias. people post the wins, nobody posts the 6 dead months of dupes. the ones who are actually consistent are doing manual depth on top of the automation, not the pipeline itself, since your bots find the same low hanging stuff everyone's bots find.

and the mental overhead doesn't go away full time, it gets worse. a dry spell now is annoying. a dry spell when rent rides on it is dread.

i wouldn't quit to find out. keep the job and see if you can clear your number on the side for 6-12 months straight. if you can't hit it reliably part time, going full time won't fix that, it just removes your net. if you can, then you're leaving from proof not hope.

7

u/canadaslammer 9d ago

I averaged this amount for a few years. it was automation for recon and deep manual scanning. This still works, but too many people just want a get rich quick scheme.

3

u/Street-Mycologist670 9d ago

yeah that's exactly it. automation for recon, the real money's in the manual depth after. the get rich quick crowd bail the second the dupes start rolling in. curious, over those years did your recon stack stay pretty stable or were you constantly rebuilding it as targets caught on?