> ## Content Index
> Fetch the complete content index at: https://cje.io/llms.txt
> Use this file to discover other available public pages before exploring further.

# No More Free-ish Bugs
- URL: https://cje.io/2026/02/12/no-more-free-ish-bugs/
- Published: 2026-02-12T17:00:00.000Z
- Updated: 2026-05-18T07:49:19.000Z
- Description: The line between bug bounty programs and vulnerability disclosure programs has blurred — and why pretending Red Bull and t-shirts count as a bounty hurts everyone.
- Author: Casey Ellis
- Tags: Policy, Learn, #disclose-io

There's a fresh conversation happening about the distinction between bug bounty programs and vulnerability disclosure programs.

This is an area where the distinction between a bug bounty program (cash or cash equivalent proactively offered to the public) and a vulnerability disclosure program (which can optionally offer a thank-you listing, swag, or some other non-financial gesture of thanks, but doesn't commit to this in advance) used to be very clear, but is now quite ambiguous.

[So I'm the guy who sent the t-shirt out as a thank you.By Ramses Martinez, Director, Yahoo Paranoids So, I am the guy who started sending t-shirts as a thanks to people when they sent us a potential vulnerability issue. What an interesting 36 hours it has been :) Here's the story. When I first took over the team that works with the security commun…Yahoo Developer Network![](https://64.media.tumblr.com/fceae6a1d5e31ce4c93ef621bba779fc/a5e8b59481609c40-72/s64x64u_c1/5694461a439249d7daabbde5aacde1122aefddb3.pnj)](https://yahoodevelopers.tumblr.com/post/62953984019/so-im-the-guy-who-sent-the-t-shirt-out-as-a-thank-you?ref=cje.io)

This is a combination of term confusion, which started around that Yahoo post, and a sudden influx of participants who aren't having their expectations set correctly.

- Offering Red Bull as a gimmick or optional gesture of thanks in the context of a VDP is appreciated, **because participation in a VDP is completely voluntary, and any "thanks" is a bonus.**
- Substituting Red Bull for cash as an incentive and calling it a bug bounty program is not, **because participation in a BBP is in exchange for the expectation of a reward, and a cash reward is expected.**