Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

PortSwigger bug bounty programs

portswigger.net Updated

PortSwigger runs one public program: a HackerOne bug bounty paying up to $15,000.

Top reward
$15,000
HackerOne
Programs
1
1 pays cash
Targets in scope
10
3 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program PortSwigger runs.

  • PortSwigger Web Security

    HackerOne · Bug bounty

    Open

    Top reward

    $15k
    Critical
    $15k
    High
    $5,000
    Medium
    $1,000
    Low
    –
    First response
    12 hours average

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

10 targets. 3 excluded.

  • ai.portswigger.net

    Web Critical

  • collections.portswigger.net

    Web Critical

  • http1mustdie.com

    Web High

  • id.portswigger.net

    Web Critical

  • links.portswigger.net

    Web Critical

  • portswigger.net

    Web Critical

  • share.portswigger.net

    Web Critical

  • Burp Collaborator

    Desktop and binaries Critical

  • Burp Suite Pro/Community

    Desktop and binaries High

  • Burp Suite DAST

    Products and areas Critical

No target matches. Try part of a host name, such as the company name.

Out of scope 3

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • *.portswigger.net

  • *.web-security-academy.net

  • Burp Suite Extension (BApps)

Recent changes

Reward and scope changes across every PortSwigger program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in PortSwigger products, from the NVD.

Search NVD
  • CVE-2022-35406 Medium

    A URL disclosure issue was discovered in Burp Suite before 2022.6. If a user views a crafted response in the Repeater or Intruder, it may be incorrectly interpreted as a redirect.

  • CVE-2021-44230 Medium

    PortSwigger Burp Suite Enterprise Edition before 2021.11 on Windows has weak file permissions for the embedded H2 database, which might lead to privilege escalation. This issue can be exploited by an adversary who has already compromised a valid Windows account on the server via separate means. In this scenario, the compromised account may have inherited read access to sensitive configuration, dat

  • CVE-2021-29416 Medium

    An issue was discovered in PortSwigger Burp Suite before 2021.2. During viewing of a malicious request, it can be manipulated into issuing a request that does not respect its upstream proxy configuration. This could leak NetNTLM hashes on Windows systems that fail to block outbound SMB.

  • CVE-2018-1153 High

    Burp Suite Community Edition 1.7.32 and 1.7.33 fail to validate the server certificate in a couple of HTTPS requests which allows a man in the middle to modify or view traffic.

  • CVE-2018-10377 Medium

    PortSwigger Burp Suite before 1.7.34 has Improper Certificate Validation of the Collaborator server certificate, which might allow man-in-the-middle attackers to obtain interaction data.

About this page

This page gathers every public program listed under portswigger.net: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.