Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

security.txt policies

Disclosure Global Updated

1,312 popular sites publish a disclosure policy in a security.txt file; 94 of them pay cash.

Popular websites that publish a vulnerability disclosure policy in their security.txt file.

Browse all 1,312 programs
Public programs
1,312
Pay cash (7%)
94
Median top reward
$1,750
Highest reward
$100k
No cash (VDP)
1,218
First response
3 d

What hunters should know

The usual complaints about bug bounty platforms, and what the data says here.

  • Triage speed

    Median first response is 3 days.

    Based on 211 programs Answer within 3 days

  • Low-severity bugs

    12 programs list a cash reward for Low. 1 start at Medium or higher. 81 publish one top amount instead of a table, so Low isn't stated.

    Based on 94 programs Pays for Low

  • Identity checks (KYC)

    13 require KYC before paying, 0 say they don't; the rest don't say.

    Based on 13 programs No KYC

  • Fees and deposits

    No program here lists a fee or deposit per report.

    Based on 1,312 programs

  • How you are paid

    78 pay in fiat money and 16 in crypto.

    Based on 94 programs Fiat only

  • Safe harbor

    180 state full safe harbor and 101 partial.

    Based on 281 programs Full safe harbor

Highest-paying programs

See all

  • Relay

    relay.link

    $100k

    from $500

    Scope
    1
    First response
    2 d
    Top severity
    Critical

  • Divar

    divar.ir

    $5,500

    from $125

    Scope
    19
    First response
    –
    Top severity
    Critical

    Safe harbor

  • Devolutions Inc.

    devolutions.net

    $5,000
    Scope
    10
    First response
    –
    Top severity
    –

  • Piwik PRO

    piwik.pro

    $3,000

    from $250

    Scope
    5
    First response
    5 d
    Top severity
    Critical

    Safe harbor

  • WalkMe

    walkme.com

    $3,000

    from $50

    Scope
    1
    First response
    –
    Top severity
    Critical

Rewards by severity

Maximum reward per severity, from USD reward tables.

Severity Programs Median Top
Critical 13 $2,500 $100k
High 13 $650 $30k
Medium 13 $300 $10k
Low 12 $100 $2,000

All 1,312 programs on security.txt policies

Search and filter without leaving the page. Filters stay in the link, so you can share a view.

112 programs match · Highest reward

  • Relay

    relay.link

    $100k

    from $500

    Scope
    1
    First response
    2 d
    Top severity
    Critical

  • Jumpseller

    jumpseller.com

    $2,500

    from $25

    Scope
    7
    First response
    3 d
    Top severity
    Critical

    Safe harbor

  • Aghanim

    aghanim.com

    $1,250

    from $50

    Scope
    23
    First response
    3 d
    Top severity
    Critical

    Safe harbor

  • Scalefusion

    scalefusion.com

    $1,000

    from $50

    Scope
    2
    First response
    2 d
    Top severity
    –

    New scope Safe harbor

  • 1&1

    1und1.de

    No cash
    Scope
    1
    First response
    1 d
    Top severity
    –

    Safe harbor

  • 84codes

    84codes.com

    No cash
    Scope
    2
    First response
    3 d
    Top severity
    –

    Safe harbor

  • Acrobits

    acrobits.net

    No cash
    Scope
    3
    First response
    2 d
    Top severity
    –

    Safe harbor

  • Adyen

    adyen.com

    No cash
    Scope
    1
    First response
    3 d
    Top severity
    –

    Safe harbor

  • AhaSlides Pte Ltd

    ahaslides.com

    No cash
    Scope
    5
    First response
    2 d
    Top severity
    –

    Safe harbor

  • Air New Zealand

    airnewzealand.co.nz

    No cash
    Scope
    36
    First response
    3 d
    Top severity
    –

    Safe harbor

  • Antagonist

    antagonist.nl

    No cash
    Scope
    1
    First response
    3 d
    Top severity
    –

    Safe harbor

  • ANWB

    anwb.nl

    No cash
    Scope
    1
    First response
    3 d
    Top severity
    –

  • Arsys

    arsys.es

    No cash
    Scope
    2
    First response
    1 d
    Top severity
    –

    Safe harbor

  • Arsys

    arsys.es

    No cash
    Scope
    2
    First response
    1 d
    Top severity
    –

    Safe harbor

  • BeenVerified

    beenverified.com

    Not published
    Scope
    4
    First response
    3 d
    Top severity
    –

    Safe harbor

  • BENQ

    benq.com

    No cash
    Scope
    2
    First response
    3 d
    Top severity
    –

  • BIT B.V.

    bit.nl

    No cash
    Scope
    1
    First response
    3 d
    Top severity
    –

    Safe harbor

  • Bosch

    bosch.com

    No cash
    Scope
    4
    First response
    2 d
    Top severity
    –

  • Cloud-IAM

    cloud-iam.com

    No cash
    Scope
    1
    First response
    1 d
    Top severity
    –

  • CloudUnifi

    cloudunifi.com

    No cash
    Scope
    6
    First response
    3 d
    Top severity
    –

    Safe harbor

  • Confused.com

    confused.com

    No cash
    Scope
    1
    First response
    2 d
    Top severity
    –

    Safe harbor

  • Cox Automotive

    coxautoinc.com

    No cash
    Scope
    9
    First response
    2 d
    Top severity
    –

  • Cresta

    cresta.com

    No cash
    Scope
    2
    First response
    1 d
    Top severity
    –

  • Cronometer

    cronometer.com

    Not published
    Scope
    3
    First response
    3 d
    Top severity
    –

    Safe harbor

  • CyberPanel

    cyberpanel.net

    No cash
    Scope
    10
    First response
    3 d
    Top severity
    –

    Safe harbor

  • Datadog

    datadoghq.com

    No cash
    Scope
    11
    First response
    1 d
    Top severity
    –

  • DataRemote, Inc.

    dataremote.com

    No cash
    Scope
    4
    First response
    3 d
    Top severity
    –

    Safe harbor

  • Datasite

    datasite.com

    No cash
    Scope
    7
    First response
    3 d
    Top severity
    –

  • De Online Drogist

    deonlinedrogist.nl

    No cash
    Scope
    2
    First response
    2 d
    Top severity
    –

  • Discord

    discord.com

    Not published
    Scope
    17
    First response
    1 d
    Top severity
    –

    Safe harbor

  • DMG MORI

    dmgmori.com

    No cash
    Scope
    3
    First response
    3 d
    Top severity
    –

  • Durian Capital Inc.

    revenuehunt.com

    No cash
    Scope
    8
    First response
    3 d
    Top severity
    –

    Safe harbor

  • Ecosia GmbH

    ecosia.org

    No cash
    Scope
    5
    First response
    3 d
    Top severity
    –

    Safe harbor

  • Elfster

    elfster.com

    No cash
    Scope
    4
    First response
    3 d
    Top severity
    –

    Safe harbor

  • Erdee Media Groep

    erdee.nl

    No cash
    Scope
    2
    First response
    3 d
    Top severity
    –

    New scope Safe harbor

  • Etwok Inc.

    netspotapp.com

    No cash
    Scope
    3
    First response
    3 d
    Top severity
    –

    Safe harbor

  • Five9

    five9.com

    No cash
    Scope
    8
    First response
    3 d
    Top severity
    –

    New scope Safe harbor

  • Fly.io

    fly.io

    No cash
    Scope
    2
    First response
    3 d
    Top severity
    –

  • Fortinet

    fortinet.com

    No cash
    Scope
    10
    First response
    1 d
    Top severity
    –

    Safe harbor