Bug bounty program in Chile
Bug bounty program in Chile: scope, a legal channel, triage, and a pool of top-tier researchers for companies in Chile and the rest of Latam. It is not a one-off pentest. It is a steady flow of real findings, and onenorma's fee is 5% of what you pay the researcher.
Top-tier researchers. You pay the reward; we charge 5%.
You only pay 5% of what you pay the researcher for each reward.
A team of experts
Our work shows up inside large companies across Latam.
Why run a bug bounty
A pentest is a snapshot of risk. A bug bounty is a living program: the surface changes and researchers keep looking.
- Continuous coverage between pentests, releases, and new surface
- You pay for real vulnerabilities, not scanner hours
- Offensive talent that does not fit inside an internal team
- A maturity signal for customers, due diligence, and Law 21.663 / ANCI
- A formal coordinated-disclosure channel, not LinkedIn reports
Benefits
Built for teams in Chile and Latam that want senior researchers without the fee of global platforms.
- Top-tier researchers, curated, with verifiable reputation
- Operations in Spanish and in the Chile and Latam time zone
- A 5% fee on each reward paid to the researcher
- You set amounts, scope, severities, and response SLAs
- Triage, duplicates, and a report engineering can use
5%. Nothing else.
onenorma's fee is 5% of each bounty you pay the researcher. If the reward is 1,000,000, we invoice 50,000. You set the payment table; the researcher receives 100% of that reward.
5%
On each reward you pay the researcher. If you pay a 1,000,000 bounty, the fee is 50,000.
You set it
You set amounts by severity. The researcher receives 100% of that table; the 5% is extra and goes to onenorma.
What this looks like in practice
HackerOne defined the category. For a local team the bottleneck is usually language, noise, and the fee. What a usable program looks like.
When you need an offensive snapshot with a date, a scope, and an executive report, the anchor is a pentest, not a bug bounty.
If the risk is in a chatbot, an agent, or MCP, the right scope is an LLM pentest in addition to the reward program.
Frequently asked questions
What is a bug bounty program?
- It is a continuous channel where security researchers test your systems under clear rules and get a reward for each valid finding. Unlike a pentest, the program does not end in two weeks: it lives with your product.
Why run a bug bounty if I already do pentesting?
- A pentest covers a scope and a date. A bug bounty covers what shows up later: a release, a new API, a misconfig. They complement each other. At onenorma you can hire a point-in-time pentest and a reward program on the same surface.
How much does onenorma charge?
- Only 5% of what you pay the researcher for the reward. There is no separate published platform fee: the commission scales with the valid bounties you decide to pay.
Who pays the researcher?
- You do. You set the table by severity (critical, high, medium, low). The researcher receives 100% of that reward. onenorma invoices 5% of that same amount to run the program, triage, and the researcher pool.
Which researchers take part?
- Top-tier, curated researchers: verifiable reputation, engaged-disclosure rules, and experience in web, API, cloud, and, when it applies, AI. The program is built for Chile and Latam, with communication in Spanish.
Does it help with Law 21.663, ANCI, or due diligence?
- Yes. A formal reporting channel, triage, and mitigation evidence is a vulnerability-management control you can show customers, auditors, and cybersecurity framework law 21.663 / ANCI. It does not replace a pentest when a contract asks for one.
Do you work with companies in Chile and Latam?
- Yes. The service is designed for teams in Chile and Latam: time zone, reports in Spanish, and a pool of regional researchers plus global talent when the scope needs it.
The pentest and the executive report from the onenorma team were very detailed, letting us act quickly and mitigate every finding in a straightforward way. Communication was fast and very clear.
Ready when you are.
Book your strategy session or email us: we reply with a clear scope and the next step.
30 minutes · No commitment · You leave with an action plan for the deals that stall