Start with web application basics: HTTP, APIs, authentication, and common vulnerability classes (XSS, SQLi, SSRF, IDOR). The OWASP Top 10 is your best friend.

Install essential tools: Burp Suite or Caido for web traffic, Frida for mobile, Postman for APIs, and a reliable VM with Kali or ParrotOS for testing.

Sharpen your skills on deliberately vulnerable applications like HackTheBox, TryHackMe, and PortSwigger's labs before hunting on live programs.

A great report includes: a clear title, affected target, steps to reproduce, proof of concept (screenshots/video), impact assessment, and suggested fix. Clarity earns higher bounties.

Begin with public VDP (Vulnerability Disclosure) programs to build confidence. Look for low-hanging fruit like exposed .git files, missing headers, and basic misconfigurations.

Consistency is key. Submit quality reports, communicate professionally, and follow each program's disclosure policy. Your Savanna Score and reputation unlock private programs and higher rewards.