Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

security.txt policies

Disclosure Global Updated

1,312 popular sites publish a disclosure policy in a security.txt file; 94 of them pay cash.

Popular websites that publish a vulnerability disclosure policy in their security.txt file.

Browse all 1,312 programs
Public programs
1,312
Pay cash (7%)
94
Median top reward
$1,750
Highest reward
$100k
No cash (VDP)
1,218
First response
3 d

What hunters should know

The usual complaints about bug bounty platforms, and what the data says here.

  • Triage speed

    Median first response is 3 days.

    Based on 211 programs Answer within 3 days

  • Low-severity bugs

    12 programs list a cash reward for Low. 1 start at Medium or higher. 81 publish one top amount instead of a table, so Low isn't stated.

    Based on 94 programs Pays for Low

  • Identity checks (KYC)

    13 require KYC before paying, 0 say they don't; the rest don't say.

    Based on 13 programs No KYC

  • Fees and deposits

    No program here lists a fee or deposit per report.

    Based on 1,312 programs

  • How you are paid

    78 pay in fiat money and 16 in crypto.

    Based on 94 programs Fiat only

  • Safe harbor

    180 state full safe harbor and 101 partial.

    Based on 281 programs Full safe harbor

Highest-paying programs

See all

  • Relay

    relay.link

    $100k

    from $500

    Scope
    1
    First response
    2 d
    Top severity
    Critical

  • Divar

    divar.ir

    $5,500

    from $125

    Scope
    19
    First response
    –
    Top severity
    Critical

    Safe harbor

  • Devolutions Inc.

    devolutions.net

    $5,000
    Scope
    10
    First response
    –
    Top severity
    –

  • Piwik PRO

    piwik.pro

    $3,000

    from $250

    Scope
    5
    First response
    5 d
    Top severity
    Critical

    Safe harbor

  • WalkMe

    walkme.com

    $3,000

    from $50

    Scope
    1
    First response
    –
    Top severity
    Critical

Rewards by severity

Maximum reward per severity, from USD reward tables.

Severity Programs Median Top
Critical 13 $2,500 $100k
High 13 $650 $30k
Medium 13 $300 $10k
Low 12 $100 $2,000

All 1,312 programs on security.txt policies

Search and filter without leaving the page. Filters stay in the link, so you can share a view.

1,312 programs · Highest reward

  • Relay

    relay.link

    $100k

    from $500

    Scope
    1
    First response
    2 d
    Top severity
    Critical

  • Divar

    divar.ir

    $5,500

    from $125

    Scope
    19
    First response
    –
    Top severity
    Critical

    Safe harbor

  • Devolutions Inc.

    devolutions.net

    $5,000
    Scope
    10
    First response
    –
    Top severity
    –

    New scope

  • Piwik PRO

    piwik.pro

    $3,000

    from $250

    Scope
    5
    First response
    5 d
    Top severity
    Critical

    Safe harbor

  • WalkMe

    walkme.com

    $3,000

    from $50

    Scope
    1
    First response
    –
    Top severity
    Critical

  • CAKE.com

    cake.com

    $2,500

    from $100

    Scope
    24
    First response
    14 d
    Top severity
    Critical

  • Jumpseller

    jumpseller.com

    $2,500

    from $25

    Scope
    7
    First response
    3 d
    Top severity
    Critical

    Safe harbor

  • ConfigCat

    configcat.com

    $2,000

    from $5

    Scope
    7
    First response
    14 d
    Top severity
    –

    Safe harbor

  • gotranscript.com

    gotranscript.com

    $2,000

    from $50

    Scope
    1
    First response
    –
    Top severity
    Critical

  • Livesport

    livesport.eu

    $2,000
    Scope
    59
    First response
    –
    Top severity
    –

    New scope

  • Fourthwall

    fourthwall.com

    $1,500

    from $50

    Scope
    8
    First response
    9 d
    Top severity
    –

  • Aghanim

    aghanim.com

    $1,250

    from $50

    Scope
    23
    First response
    3 d
    Top severity
    Critical

    Safe harbor

  • Scalefusion

    scalefusion.com

    $1,000

    from $50

    Scope
    2
    First response
    2 d
    Top severity
    –

    New scope Safe harbor

  • UXCam

    uxcam.com

    $1,000

    from $50

    Scope
    13
    First response
    5 d
    Top severity
    Critical

    Safe harbor

  • Porkbun LLC

    porkbun.com

    $750
    Scope
    7
    First response
    –
    Top severity
    Critical

  • Emsisoft

    emsisoft.com

    $500
    Scope
    1
    First response
    1 d
    Top severity
    –

  • SoSci Survey GmbH

    soscisurvey.de

    €250

    from €25

    Scope
    2
    First response
    5 d
    Top severity
    –

    Safe harbor

  • Waitwhile

    waitwhile.com

    $250

    from $25

    Scope
    4
    First response
    –
    Top severity
    Critical

    Safe harbor

  • Hubstaff

    hubstaff.com

    $100
    Scope
    4
    First response
    14 d
    Top severity
    –

  • Reedsy

    reedsy.com

    $100

    from $10

    Scope
    3
    First response
    –
    Top severity
    Critical

    Safe harbor

  • 10be.de

    10be.de

    No cash
    Scope
    1
    First response
    –
    Top severity
    –

  • 1&1

    1und1.de

    No cash
    Scope
    1
    First response
    1 d
    Top severity
    –

    Safe harbor

  • 123greetings.com

    123greetings.com

    No cash
    Scope
    1
    First response
    –
    Top severity
    –

  • 123inkt.nl

    123inkt.nl

    No cash
    Scope
    1
    First response
    –
    Top severity
    –

  • 12Build

    12build.com

    No cash
    Scope
    1
    First response
    7 d
    Top severity
    –

  • 1win.lat

    1win.lat

    No cash
    Scope
    3
    First response
    –
    Top severity
    –

    New scope

  • 23video.com

    23video.com

    No cash
    Scope
    2
    First response
    –
    Top severity
    –

  • 2brightsparks.com

    2brightsparks.com

    No cash
    Scope
    1
    First response
    –
    Top severity
    –

  • 2carpros.com

    2carpros.com

    No cash
    Scope
    1
    First response
    –
    Top severity
    –

  • 3saf.com

    salla.com

    No cash
    Scope
    14
    First response
    –
    Top severity
    –

    New scope

  • 84codes

    84codes.com

    No cash
    Scope
    2
    First response
    3 d
    Top severity
    –

    Safe harbor

  • 90phutzac.tv

    90phutzac.tv

    No cash
    Scope
    3
    First response
    –
    Top severity
    –

  • abbywinters.com

    abbywinters.com

    No cash
    Scope
    1
    First response
    –
    Top severity
    –

  • abc.net.au

    abc.net.au

    No cash
    Scope
    1
    First response
    –
    Top severity
    –

  • ABCP Platform

    abcp.ru

    No cash
    Scope
    4
    First response
    –
    Top severity
    –

  • ABCP Platform

    abcp.online

    No cash
    Scope
    5
    First response
    –
    Top severity
    –

  • aber.ac.uk

    aber.ac.uk

    No cash
    Scope
    1
    First response
    –
    Top severity
    –

  • abnormalsecurity.com

    abnormalsecurity.com

    No cash
    Scope
    2
    First response
    –
    Top severity
    –

    New scope

  • abola.pt

    abola.pt

    No cash
    Scope
    1
    First response
    –
    Top severity
    –

  • abr.gov.au

    abr.gov.au

    No cash
    Scope
    1
    First response
    –
    Top severity
    –

  • Acast Group

    acast.com

    No cash
    Scope
    1
    First response
    –
    Top severity
    –

  • Acrobits

    acrobits.net

    No cash
    Scope
    3
    First response
    2 d
    Top severity
    –

    Safe harbor

  • actblue.com

    actblue.com

    No cash
    Scope
    1
    First response
    –
    Top severity
    –

  • act.gov.au

    act.gov.au

    No cash
    Scope
    1
    First response
    –
    Top severity
    –

  • adata.kz

    adata.kz

    No cash
    Scope
    1
    First response
    –
    Top severity
    –

  • adcreative.ai

    adcreative.ai

    No cash
    Scope
    1
    First response
    –
    Top severity
    –