Bug bounties have become an established process in organisations with a mature security posture. Over the last five years, I have been submitting vulnerabilities to companies in almost every industry. By participating in bug bounties over such a long period of time, there has been an evolution in the skills, reporting and payouts. There is a broad perception in bounties that there is a secret to unlock to be successful and only a handful of individuals are capable of that success. This presentation will break down why that is not the case. I will walk through all of my favourite bugs that I have found in the last five years, explaining step by step what led to the discoveries. I will discuss some of the lessons I have learned from my participation, and how you can replicate my success.