Some programs require you to register an account to report a bug while others use email, but you don't need to get permission to look. All bug bounty programs

Some programs require you to register an account to report a bug while others use email, but you don't need to get permission to look. All bug bounty programs have rules that outline what parts of their site/product you can test and what kinds of bugs they are looking for (here's Facebook's https://www.facebook.com/whitehat/ https://www.facebook.com/whitehat/). As long as you follow the rules you won't have any legal problems.