Here’s a scenario that happens more than people realize. You’re poking around a website — maybe just out of curiosity, maybe learning how web apps work — and you stumble onto something. A real security hole. User data exposed, or a backdoor that shouldn’t be there. You think, I should tell them. So you do.
And then you get a lawyer’s letter. Or worse.
The law that makes this possible is called the Computer Fraud and Abuse Act, or CFAA. It’s a federal law, and it’s been around since 1986. The problem is it was written before modern security research was even a thing, and it’s broad enough that accessing a system “without authorization” can be a crime — even if your intent was to help.
You don’t have to steal anything. You don’t have to use the vulnerability for anything bad. The act of discovering it in a way the company didn’t explicitly permit can technically be enough.
Now, the Department of Justice has said that security research conducted “in good faith” is something they factor into decisions about prosecution. But “good faith” isn’t a magic shield — it applies to how federal prosecutors exercise discretion, not to whether a company can still sue you in civil court. And companies don’t have to wait for the DOJ — they can sue you on their own. It’s also worth knowing that many states have their own computer crime laws that can apply separately from federal law, so the legal risk doesn’t stop at the CFAA.
This is exactly why bug bounty programs exist. A bug bounty is a formal agreement where a company says, in writing: we give you permission to test our systems, and if you find something real, we’ll pay you. That written agreement is your primary legal protection. Without it, you’re operating in a gray zone that has swallowed people’s lives.
The key word is written. A company saying “yeah we welcome responsible disclosure” in a vague blog post isn’t the same thing. Security experts at OWASP specifically flag this — even many official bug bounty programs have rules that forbid you from publishing what you found without the company’s approval. So even participating in a program comes with strings you need to read before you start.
If you want to do this kind of work — and it’s genuinely valuable, companies need people who can find these holes — here’s what you do first. Look for a written, published bug bounty program on the company’s website. Platforms like HackerOne and Bugcrowd host legitimate programs with clear terms. Read the scope rules carefully. Some programs exclude certain systems entirely. If something isn’t explicitly in scope, don’t touch it.
And if you ever find something on a system with no bug bounty program at all? That’s the riskiest situation. You have essentially no protection. Disclosing it anyway is a personal judgment call with real legal exposure attached.
This isn’t meant to scare you away from security work — it’s one of the most in-demand fields in tech. It’s just that the rules of the road here are genuinely different from most other fields, and learning them before you need them is a lot better than learning them after.