- paying
- 475
- top reward
- $1M
- median top
- $1,500
- new, 90 d
- 0
- changes, 30 d
- 0
- first response
- 3 d
Bug bounty platforms compared
26 platforms with public programs, ranked by how many programs are open right now. Sorona has the most open programs (475).
Updated
26 of 26 platforms · Open programs
-
-
- paying
- 287
- top reward
- $1M
- median top
- $8,000
- new, 90 d
- 7
- changes, 30 d
- 321
- first response
- 2 d
-
- paying
- 300
- top reward
- $3M
- median top
- $3,500
- new, 90 d
- 0
- changes, 30 d
- 71
- first response
- 4 d
-
- paying
- 151
- top reward
- €51.3k
- median top
- €4,000
- new, 90 d
- 9
- changes, 30 d
- 645
- first response
- 5 d
-
- paying
- 325
- top reward
- $58M
- median top
- $10k
- new, 90 d
- 10
- changes, 30 d
- 68
- first response
- 3 d
-
- paying
- 154
- top reward
- $10M
- median top
- $100k
- new, 90 d
- 4
- changes, 30 d
- 241
- first response
- 14 d
-
- paying
- 89
- top reward
- $725.9k
- median top
- $6,049
- new, 90 d
- 1
- changes, 30 d
- 11
- first response
- –
-
- paying
- 51
- top reward
- €230k
- median top
- €3,000
- new, 90 d
- 0
- changes, 30 d
- 49
- first response
- 1 d
-
- paying
- 50
- top reward
- $1M
- median top
- $10k
- new, 90 d
- 1
- changes, 30 d
- 6
- first response
- –
-
- paying
- 12
- top reward
- $36.2k
- median top
- $12.1k
- new, 90 d
- 3
- changes, 30 d
- 0
- first response
- –
-
- paying
- 48
- top reward
- $15.5M
- median top
- $450k
- new, 90 d
- 3
- changes, 30 d
- 15
- first response
- –
-
- paying
- 0
- top reward
- $500k
- median top
- $27.5k
- new, 90 d
- 0
- changes, 30 d
- 0
- first response
- –
-
- paying
- 9
- top reward
- $12.1k
- median top
- $6,639.50
- new, 90 d
- 0
- changes, 30 d
- 0
- first response
- –
-
- paying
- 44
- top reward
- $1M
- median top
- $50k
- new, 90 d
- 0
- changes, 30 d
- 2
- first response
- –
-
- paying
- 37
- top reward
- $16M
- median top
- $200k
- new, 90 d
- 12
- changes, 30 d
- 10
- first response
- –
-
- paying
- 34
- top reward
- $2,500
- median top
- $500
- new, 90 d
- 0
- changes, 30 d
- 0
- first response
- –
-
- paying
- 15
- top reward
- ¥5M
- median top
- ¥300k
- new, 90 d
- 4
- changes, 30 d
- 0
- first response
- –
-
- paying
- 4
- top reward
- $10k
- median top
- $3,000
- new, 90 d
- 1
- changes, 30 d
- 3
- first response
- –
-
- paying
- 12
- top reward
- $12.1k
- median top
- $6,036
- new, 90 d
- 1
- changes, 30 d
- 2
- first response
- –
-
- paying
- 8
- top reward
- $250k
- median top
- $15k
- new, 90 d
- 5
- changes, 30 d
- 0
- first response
- –
-
- paying
- 0
- top reward
- –
- median top
- –
- new, 90 d
- 1
- changes, 30 d
- 0
- first response
- –
-
- paying
- 4
- top reward
- $300k
- median top
- $55k
- new, 90 d
- 0
- changes, 30 d
- 3
- first response
- –
-
- paying
- 3
- top reward
- $148.9k
- median top
- $1,489
- new, 90 d
- 0
- changes, 30 d
- 0
- first response
- –
-
- paying
- 0
- top reward
- $15k
- median top
- $15k
- new, 90 d
- 1
- changes, 30 d
- 3
- first response
- –
-
- paying
- 1
- top reward
- $15k
- median top
- $15k
- new, 90 d
- 0
- changes, 30 d
- 0
- first response
- –
-
- paying
- 1
- top reward
- –
- median top
- –
- new, 90 d
- 0
- changes, 30 d
- 0
- first response
- –
Open programs are live today; public counts also include paused ones. Counts cover programs anyone can read, plus those any free account can see. Median and highest rewards use each platform's most common currency. “New” counts programs the platform says launched in the last 30 or 90 days, and “changes” counts scope and rule changes recorded in the last 30 days. First response is the median of programs where it is known: the platform's measured average, or the time the policy promises.
Most active programs this month
Programs with the most scope and rule changes in the last 30 days. Fresh changes usually mean fresh bugs.
-
Uphold
Intigriti · €6,000
35 changes
-
Here Technologies
Intigriti · €2,000
31 changes
-
TrueLayer
Intigriti · €6,000
29 changes
-
Lightspark Public Bug Bounty
Intigriti · $5,000
27 changes
-
DataCamp
Intigriti · €1,500
25 changes
-
John Deere
HackerOne · No cash
24 changes
-
PDQ bug bounty program
Intigriti · €3,500
20 changes
-
WP Engine Bug Bounty
Intigriti · €2,500
14 changes
Not on a platform
Companies that take reports on their own site.
Platforms we can't list
These platforms exist, but their programs can't be listed: they are private, need an invitation, or block automated reading. We never get around a login or a block to collect data.
-
WordfenceComing soon
WordPress plugins and themes.
-
Open Bug BountyBlocks automated access
Free disclosure platform. Refuses automated access, so not collected.
-
Code4renaShut down
Shut down in 2026. Immunefi took over its bounty clients.
-
FederacyShut down
Public program API returns no programs.
-
Hats FinanceShut down
Closed its app and servers at the end of 2025.
-
CobaltInvite only
Pentest as a service, private.
-
SynackInvite only
Vetted, private crowd.
-
YogoshaInvite only
Private programs only.
-
ZerocopterInvite only
Private programs only.
-
HackrateLogin required
Program list is only shown after signing in.
-
Secure3No public program list
No public bounty listing found on its site.
