How do I report a bug I found to a crypto project's bounty program?

Most crypto projects offer bug bounty programs through platforms like Immunefi or HackerOne, or directly on their websites. Start by finding the project's security page or documentation. Report bugs privately to their security team rather than publicly discussing vulnerabilities. Include detailed information: what the bug is, how to reproduce it, and its potential impact. Avoid accessing systems beyond what's necessary to verify the issue. Legitimate projects will acknowledge your report and may reward you with cryptocurrency based on severity. Response times vary, but reputable teams typically respond within days. Never share sensitive data unnecessarily, and follow the program's specific guidelines for disclosure timelines.