How the data works

Where it comes from

Programs come from 28 platforms, read through each platform's public pages or its read-only API, and from companies that run their program on their own site. Each platform has its own page with its count and notes:

When two readings of a program disagree, the more complete one wins field by field: scope is the union of both, the platform's own reward table beats any summary, and a reward quoted word for word from the company's policy beats both.

How fresh it is

Most platforms are checked every one to six hours, company policies once a day. Every program page shows when it was last checked. If a platform is down, its programs keep their last known state and nothing is marked as changed.

How a change is confirmed

Each check is compared with the one before. Reordering, spacing and page counters are ignored; only real differences count.

New programs, added scope and raised rewards are shown straight away.
Removed scope, cut rewards and closed programs must show up on two checks in a row, so a platform's bad minute doesn't look like a cut.
If one check would remove more than a fifth of a platform's programs or of one program's scope, it is held for a manual look.
The first time a program is seen, one line says it launched. Its scope at that point is the starting record, not a list of additions.
When we start reading a program in more detail, the extra facts are added quietly instead of flooding the Changes feed.

Rewards and currencies

Amounts are shown in the program's own currency, as the program states them. Sorting and "pays the most" compare US dollar equivalents. A minimum ("from $500") is never shown as a top reward, and money that is not a bug reward (totals paid, pricing, insurance) is ignored.

Company-run programs

Many companies run their program on their own site. We follow a list of those pages and check popular websites for a security.txt file. A site is listed only when it publishes a policy or a bounty page; we never guess at private programs.

Policies are long and every company writes them differently, so they are summarised with AI: rewards per severity, scope, testing rules, excluded bug types, response times and legal terms. Each fact is kept only if it appears on the page word for word, and it is shown with that sentence and the date it was read. A page is read again only when its text changes. When a page is ambiguous or can't be read, we show nothing rather than guess. A security.txt listing is a disclosure policy, not a bounty, unless the policy says it pays.

Platform programs are summarised the same way from the policy text the platform publishes. Every summary on a program page says so and links to the original, and where we keep a copy of the text you can read it right there.

Company pages

A company page puts every public program for that company side by side. Large groups are joined up: YouTube and Android lead to Google's page, which lists every unit's programs. Ownership links are kept only when the parent is named in the program's own text or in a public acquisition record.

CVEs

Public CVE records are matched to a program by vendor name. Name matching is imperfect: products sold under another brand can be missed, and two companies with the same name can collide. Where a platform publishes its own CVE count for a project, that count is shown as given.

What we never do

Store invite-only or private programs, even if they leak elsewhere.
Get past logins, CAPTCHAs or bot checks. Platforms are read through public pages or their official API.
Disguise the collector. It identifies itself, waits between requests and backs off when asked.

Follow changes

Every confirmed change is in the RSS feed, for any feed reader.