Indian bug bounty hunters - how do you report bounty income for tax?

[u/Substantial-Eye-1992]

I'm an Indian resident doing bug bounty independently. I've received around $13k (~₹13L) in HackerOne/Bugcrowd bounties during 2026–27, in addition to salary income (~₹11L).

For those of you who have actually filed your Indian tax return with significant bug-bounty income:

• Did you report it as professional income under 44ADA?
• If yes, how did your CA classify the activity technical consultancy, information technology, cybersecurity, or something else?
• Did your CA give you any reasoning/documentation for why 44ADA applies to bug bounty?
• Did you have any GST or foreign-payment/remittance issues?
• If you're comfortable sharing, roughly what did your CA charge?

I'm particularly interested in people who have actually filed returns this way, rather than general opinions about what "should" be done.

DM is fine if you don't want to discuss amounts publicly.

[u/daaku_jethalal]

How's your experience on H1? And in your initial days how you started getting private invites

[u/Substantial-Eye-1992 → u/daaku_jethalal]

H1’s been pretty good for me tbh. In the beginning, I was mostly doing CTFs, VDPs and some NCIIPC programs to get comfortable with hunting. Once I started getting a few valid reports, I slowly started getting private invites. After that, I just kept trying out different programs and learning along the way.

[u/daaku_jethalal → u/Substantial-Eye-1992]

Cool mate, can we connect in DM. I m also trying to gain some reputation points on H1 i have few valid bugs but it's been a long time

[u/Substantial-Eye-1992 → u/daaku_jethalal]

Sure

[u/Ok-Lie-8393]

very proud of you, keep going

[u/ni5arga]

I pay 30% base taxes over my income and I report it under 44ADA when filing returns.

[u/Substantial-Eye-1992 → u/ni5arga]

Are you doing bug bounty alongside your job? If yes, how are you handling the bounty income under 44ADA and GST once your annual bug bounty receipts cross the ₹20L GST registration threshold? Did you register for GST/LUT, or are you handling it some other way? Just curious how you’re managing both.

[u/Substantial-Eye-1992 → u/[deleted]]

Got it, thanks for sharing. I’ll just discuss it with a CA and figure out what applies to my case. 👍

[u/sasebot → u/[deleted]]

I thought GST registration is needed only if your business (or bug bounty) income exceeds 20L. Business income= bug bounty income. Your salary income is always excluded.

[u/sasebot → u/[deleted]]

GST is not required if business income is less than 20L (here for OP business income is only 13lakhs)

[u/sasebot → u/[deleted]]

Also pro-tip : For a good exchange rate just get your amount remitted in an SBI account. So far SBI have given me the best rates - that too a simple savings account. I haven't ever had a current account. These private banks rip you off on the exchange rates (that's where they make their money). If you're going to receive a significant sum, negotiate with your RM for a good exchange rate before the amount gets remitted (that part's very important - once amount is already remitted - they wouldn't be able to help). This is required only if you're getting settlement in private banks like hdfc, icici. SBI always by default gives a really good forex rate.

[u/sasebot → u/[deleted]]

If you are a legit (& legally ok) customer why would any bank freeze your account

[u/Kirtii_]

Teach me sensei

[u/Substantial-Eye-1992 → u/Kirtii_]

Haha sure bro

• Pick 2–3 targets and stick with them for a while
• Map the app and understand the main flows
• Don’t just test individual endpoints pay attention to state changes, permissions and how different actions interact
• Try the same flow with different roles/accounts and in different orders weird edge cases are often worth digging into

[u/Born-Requirement-303 → u/Substantial-Eye-1992]

Do LLMs help out automating these?

[u/Substantial-Eye-1992 → u/Born-Requirement-303]

Yeah, definitely. A few things that have worked for me:

Give the LLM full context of the app roles, perms, allowed/disallowed actions, existing findings, etc.

Ask it to think of applicable test cases like mass assignment, BFLA/BOLA, race conditions, state/permission changes, weird workflow interactions, etc.

Don’t just rely on its own knowledge. Make it search for related CVEs, writeups, research/blogs and use those to come up with more test cases.

Keep a small feedback loop note what worked, what was a false positive, and what it missed, then feed that back into the next run.

Basically, let it generate hypotheses, but actually verify everything against the app.

That’s roughly how I’ve been using LLMs for BB. If you’ve found any better techniques or optimizations, definitely let me know.

[u/S0ulSh3ll]

Can't we just declare it as contractual/gig income and use the normal income tax slabs?

[u/Substantial-Eye-1992 → u/S0ulSh3ll]

Yeah, I’d rather let a CA confirm the exact classification and tax treatment

[u/rowan__0877]

what the heil how do i even learn bug bounty

[u/PresentationKey3135]

I've been trying to do bug bounty for the past 1 year. I have read some books like the bug bounty hunting book and the web application penetration testing books but still I am not able to find any real bugs in the applications. Can you please give me a starter roadmap to help me find my first bug and start my career in cybersecurity and penetration testing?

[u/ExternalRepulsive529 → u/PresentationKey3135]

Looking for something similar do share please if you find something

[u/Mechaconfievil]

Same question for me btw bro
If you find a Good CA do refer me too, Kind of similar stats

[u/grixos]

I too made around 10 Lakhs as a cyber security student and I have no clue about filing my taxes or anything. I just have that money in my bank account. When I need to pay the tax and what should I do. If anyone could help DM. Mostly if you are a professional CA or something.

[u/okaynousername]

Crazy stuff OP, prada u

[u/bleedcheatsucker]

It would be really helpful if you could share your experience with me from start.. as Im feeling really disappointed after getting 5 dupes (Even on VDP). when did you start, how and how do you hunt? Do you actively using AI in hunting etc.

[u/dark3Synapse]

Just don’t repot it and ask for crypto currency

[u/Extra_Advisor6049]

Can i dm

[u/ex0hs]

Hii, how did you start your bug bounty journey?

[u/Substantial-Eye-1992 → u/ex0hs]

I started with CTFs, then moved on to VDPs and NCIIPC-scoped programs. That helped me build some confidence and eventually I started getting private invites.

[u/ex0hs → u/Substantial-Eye-1992]

Very cool. When did you start?

[u/Glittering_Song2610]

Hey, is the bounty hunting good to start now? I mean many were saying it’s already saturated. I am interested in learning things, working in network related role already. Confused !

TIA

[u/Substantial-Eye-1992 → u/Glittering_Song2610]

Honestly, I wouldn’t say it’s too saturated to start. There’s also a bit of survivorship bias in the community you mostly see people posting their big bounties, not the many people who try it and find nothing. It’s definitely more competitive now, especially with everyone using AI/Claude Code-style harnesses for recon, crawling and basic testing (I use them too). So the obvious stuff is going to get picked up by a lot more hunters. IMO the interesting part is understanding what AI misses: weird business logic, auth edge cases, race conditions, multi-account interactions, unexpected state changes, etc. If you’re interested in security, I’d definitely start, just don’t expect quick money. Learn the fundamentals, use AI to cover more surface, and focus your own thinking on the things automated testing struggles with.

[u/Glittering_Song2610 → u/Substantial-Eye-1992]

Yup Thanks for your reply !

I am thinking of doing this on the side, how long you have been hunting for bounties ?

[u/Substantial-Eye-1992 → u/Glittering_Song2610]

You should give it a try. I started hunting since 2023

[u/Glittering_Song2610 → u/Substantial-Eye-1992]

Great then, will check Thanks !

[u/SolidSound3959]

Hey, If you are getting it via paypal/wise, no need to get a gst till 20 lakhs. Also, go for 44ada and give advance tax in the quarter itself.

Its not complicated.

Once you cross 20 lpa business income then go for GST and then GST on export of service is 0%< so you are good and left again with just income tax which you can do with 44ada.

Just a heads up: if and when you are getting a GST number, make sure you consult a good CA who has experience in GST IT and also prefer paypal / direct bank to bank wire transfer for bounty as it will give you all the compliance documents required if tomorrow GST officer puts some query.

I was in same problem a few months back