Bug bounty program changes

What moved on public bug bounty programs, newest first. Cuts, removals and closures are confirmed on a second check before they show.

Updated 12 Nov 2026, 20:34 UTC

RSS feed

Last 7 days

Scope added: 258
Rewards raised: 4
Cuts and removals: 8
New programs: 0

Platform When Direction

443 changes

Today 30 changes

USA TODAY Co. 17:10

Scope + security.txt

Added to scope: newsherald.com
USA TODAY Co. 17:10

Scope + security.txt

Added to scope: norwichbulletin.com
USA TODAY Co. 17:10

Scope + security.txt

Added to scope: nwfdailynews.com
USA TODAY Co. 17:10

Scope + security.txt

Added to scope: palmbeachdailynews.com
USA TODAY Co. 17:10

Scope + security.txt

Added to scope: poconorecord.com
USA TODAY Co. 17:10

Scope + security.txt

Added to scope: pressconnects.com
USA TODAY Co. 17:10

Scope + security.txt

Added to scope: uticaod.com
expedia.com 17:10

Scope + security.txt

Added to scope: expedia.com.hk
expedia.com 17:10

Scope + security.txt

Added to scope: expedia.es
USA TODAY Co. 17:10

Scope + security.txt

Added to scope: heraldnews.com
USA TODAY Co. 17:10

Scope + security.txt

Added to scope: heraldtimesonline.com
News Corp 17:10

Scope + security.txt

Added to scope: geelongadvertiser.com.au
News Corp 17:10

Scope + security.txt

Added to scope: goldcoastbulletin.com.au
codeberg.org 17:10

Scope + security.txt

Added to scope: gitdab.com
studocu.com 17:10

Scope + security.txt

Added to scope: studeersnel.nl
ADAC Bug Bounty Program 16:33

Paused Intigriti

Paused. Not accepting reports right now.
State Voices Florida 16:25

Raised Self-hosted

Top reward now listed: $1,000,000.
Fyxer 16:25

Raised Self-hosted

Top reward now listed: $10,000.
Telekom 16:25

Raised Self-hosted

Top reward now listed: €10,000.
Storebrand Responsible Disclosure 14:33

Scope + Intigriti

Added to scope: Kron - Sparing og pensjon - Android
Storebrand Responsible Disclosure 14:33

Scope + Intigriti

Added to scope: Kron - Sparing og pensjon - iOS
Divvy Homes 14:13

Back HackerOne

Open for reports again.
Water-Link 12:32

Back Intigriti

Open for reports again.
Telenor Sweden Public Bug Bounty Program 10:39

Scope + YesWeHack

Added to scope: butik.vimla.se
Lansweeper Bug Bounty Program 10:32

Paused Intigriti

Paused. Not accepting reports right now.
DataCamp 10:32

Back Intigriti

Open for reports again.
Cloudflare Public Bug Bounty 09:07

Scope + HackerOne

Added to scope: https://github.com/cloudflare/boringtun
Moneytree KK 04:28

Scope − Bugcrowd

Removed from scope: https://fitbit-lottery.getmoneytree.com/
Optus Managed Bug Bounty 03:56

Scope + Bugcrowd

Added to scope: brand.optus.com.au
Moneytree KK 03:02

Scope + Bugcrowd

Added to scope: https://fitbit-lottery-staging.getmoneytree.com/

Yesterday 11 changes

Veriff Bug Bounty 23:51

Paused Intigriti

Paused. Not accepting reports right now.
Hilton 17:37

Scope + HackerOne

Added to scope: *.hilton.com.cn
Unico IDtech 15:25

Scope + HackerOne

Added to scope: developer.unico.io
Unico IDtech 15:07

Scope + HackerOne

Added to scope: dashboard.unico.app
Unico IDtech 15:07

Scope + HackerOne

Added to scope: api.humantoken.unico.app
Unico IDtech 15:07

Scope + HackerOne

Added to scope: humantoken.unico.app
UFarm Digital 13:11

Back Remedy

Open for reports again.
BitMEX 09:25

Back HackerOne

Open for reports again.
Superbet 08:07

Scope + HackerOne

Added to scope: *.maxbet.ro
Easy Agile 05:56

Scope + Bugcrowd

Added to scope: https://marketplace.atlassian.com/apps/1219491/easy-agile-programs-pi-planning-program-board-dependencies?hosting=cloud&tab=overview
pixiv 00:54

Cut HackerOne

Top reward $7,500 to $5,000.

Tuesday, 10 November 14 changes

Zebra VDP 21:27

Scope + HackerOne

Added to scope: vod.zebra.com
Shopify 21:07

Scope + HackerOne

Added to scope: shop.com
Shopify 20:57

Scope + HackerOne

Added to scope: *.shopifysvc.com
Shopify 20:57

Scope + HackerOne

Added to scope: shopify.photo
Shopify 20:57

Scope + HackerOne

Added to scope: help.shop.app
Shopify 20:57

Scope + HackerOne

Added to scope: shopifypartnerships.com
Shopify 20:57

Scope + HackerOne

Added to scope: shopifyevents.com
Shopify 20:57

Scope + HackerOne

Added to scope: Shop Minis
Shopify 20:45

Scope + HackerOne

Added to scope: Sidekick
Zynk Protocol 15:38

Paused HackenProof

Paused. Not accepting reports right now.
SBB - Swiss Federal Railways 14:58

Scope + Intigriti

Added to scope: *.event.sbb.ch
Bitpanda Ongoing Bug Bounty 09:06

Scope + Bugcrowd

Added to scope: https://login.bitpanda.com
Walt.io 08:47

Scope + HackerOne

Added to scope: io.walt.app
Dynatrace 08:04

Paused HackerOne

Paused. Not accepting reports right now.

Monday, 9 November 11 changes

John Deere 19:08

Scope + HackerOne

Added to scope: mailhost.johndeere.com
City of Vienna Managed Bug Bounty 17:26

Scope + Bugcrowd

Added to scope: https://data.wien.gv.at/daten/*
CBRE 17:10

Scope + HackerOne

Added to scope: market-survey.cbre.com
CBRE 17:10

Scope + HackerOne

Added to scope: tenant-tour.cbre.com
Mars 17:09

Scope + HackerOne

Added to scope: marschina.com
Canada Post - Responsible Disclosure Program 16:30

Scope + Intigriti

Added to scope: *.canadapost.ca
John Deere 16:18

Scope + HackerOne

Added to scope: extraparts.deere.com
Canada Post - Responsible Disclosure Program 15:57

Scope + Intigriti

Added to scope: *.aws.canadapost-postescanada.ca
Fresenius 13:24

Back HackerOne

Open for reports again.
Oasis Protocol Foundation 08:44

Back HackerOne

Open for reports again.
Cronos zkEVM Smart Contracts 06:26

Cut HackenProof

Top reward $200,000 to $50,000.

Saturday, 7 November 2 changes

Dropbox Bug Bounty 04:32

Scope + Intigriti

Added to scope: *.tigrisdata.io
Dropbox Bug Bounty 04:32

Scope + Intigriti

Added to scope: *.tigrisdata.com

Friday, 6 November 21 changes

AWS VDP 20:35

Scope + HackerOne

Added to scope: https://github.com/aws/s2n-quic
MariaDB 20:23

Back HackerOne

Open for reports again.
FanDuel 19:25

Scope + HackerOne

Added to scope: FanDuel Customer Support Sites
AT&T 18:05

Scope + HackerOne

Added to scope: http://accesspro.att.com
Hyatt Hotels 16:55

Scope − HackerOne

Removed from scope: hyatt.com
Epic Games 16:35

Scope + HackerOne

Added to scope: Zenserver
Braze, Inc. 15:45

Scope + HackerOne

Added to scope: https://bug-bounty-mcp.k8s.tools-001.d-use-1.braze-dev.com/mcp
Attentia VDP 11:03

Back Intigriti

Open for reports again.
HARMAN International - Web Applications 10:52

Scope − YesWeHack

Removed from scope: https://jp.jbl.com
HARMAN International - Web Applications 10:52

Scope − YesWeHack

Removed from scope: https://pl.jbl.com
HARMAN International - Web Applications 10:52

Scope − YesWeHack

Removed from scope: https://jp.harmanaudio.com
HARMAN International - Web Applications 10:49

Cut YesWeHack

Top reward $4,000 to $2,000.
YesWeHack Dojo 09:42

Scope + YesWeHack

Added to scope: https://dojo-yeswehack.com/challenge-of-the-month/dojo-56
Anduril Industries 06:55

Scope + HackerOne

Added to scope: anduril.com
Bybit Fintech Ltd 03:55

Scope + HackerOne

Added to scope: https://testnet.bybit.com/en/earn/rwa/
Bybit Fintech Ltd 03:45

Scope + HackerOne

Added to scope: https://www.bybit.com/en/stocks
Henkel 03:25

Scope + HackerOne

Added to scope: *.nymbrands.{com,co.uk,uk,}
Henkel 03:25

Scope + HackerOne

Added to scope: *.nymhair.{com,co.uk,uk,}
Henkel 03:25

Scope + HackerOne

Added to scope: *.nymbrand.{com,co.uk,uk,}
OPPO 02:33

Raised HackerOne

Top reward $11,500 to $12,000.
Sqills 02:18

Paused Intigriti

Paused. Not accepting reports right now.

Thursday, 5 November 9 changes

John Deere 16:16

Scope + HackerOne

Added to scope: es-develop-api.channel-expertservices-prod-vpn.us.e00.c01.johndeerecloud.com
John Deere 14:26

Scope + HackerOne

Added to scope: ai-playbook-kit.mfg-material-management-devl-vpn.us.e11.c01.johndeerecloud.com
Resolution 14:16

Scope + Bugcrowd

Added to scope: https://marketplace.atlassian.com/apps/1228240/hubspot-jira-crm-issue-link-integration-collaboration?hosting=cloud&tab=overview
Judge.me 11:23

Scope + HackerOne

Added to scope: emails.judge.me
hostinger 10:15

Scope + HackerOne

Added to scope: ai-builder.hostinger.com
Stripe 05:03

Cut HackerOne

Top reward $25,000 to $15,000.
Stripe 04:35

Scope + HackerOne

Added to scope: stripe.com
Stripe 04:35

Scope + HackerOne

Added to scope: files.stripe.com
Stripe 04:35

Scope + HackerOne

Added to scope: stripe.dev

Wednesday, 4 November 2 changes

Remitly 22:45

Scope + HackerOne

Added to scope: api.remitly.com
John Deere 21:56

Scope + HackerOne

Added to scope: leasedataservice.deere.com