In simple terms, a bug bounty program comprises freelance white hat testers finding and validating exploits, in exchange for notoriety and money. In certain rare cases, the activities that a bug bounty hunter is able to undertake might be carefully controlled by the SaaS vendor, but that really defeats the purpose of this exercise. Most bug bounty hunters usually follow a 'free-for-all' strategy. They don't really follow a specific penetration testing framework, instead they work on evaluating automated vulnerability scan results.