Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Self-hosted programs

Web and apps Global Updated

2,175 companies run their own bug bounty or disclosure program; 641 of them pay cash.

Companies that run their own program on their own site.

Browse all 2,175 programs
Public programs
2,175
Pay cash (29%)
641
Median top reward
$4,999.50
Highest reward
$5M
No cash (VDP)
1,534
New, 30 / 90 days
4 / 6
First response
3 d
Reward changes, 90 d
+3 / −0

What hunters should know

The usual complaints about bug bounty platforms, and what the data says here.

  • Triage speed

    Median first response is 3 days.

    Based on 618 programs Answer within 3 days

  • Reward changes

    3 reward raises and 0 cuts in the last 90 days.

    Based on 2,175 programs

  • Low-severity bugs

    35 programs list a cash reward for Low. 15 start at Medium or higher. 591 publish one top amount instead of a table, so Low isn't stated.

    Based on 641 programs Pays for Low

  • Identity checks (KYC)

    32 require KYC before paying, 3 say they don't; the rest don't say.

    Based on 35 programs No KYC

  • Fees and deposits

    No program here lists a fee or deposit per report.

    Based on 2,175 programs

  • How you are paid

    591 pay in fiat money and 50 in crypto.

    Based on 641 programs Fiat only

  • Safe harbor

    433 state full safe harbor and 292 partial.

    Based on 1,030 programs Full safe harbor

  • Unclear scope

    830 list no in-scope targets publicly: read the policy before testing.

    Based on 2,175 programs

Highest-paying programs

See all

Rewards by severity

Maximum reward per severity, from USD reward tables.

Severity Programs Median Top
Critical 43 $5,000 $1M
High 42 $2,000 $150k
Medium 41 $500 $100k
Low 31 $200 $3,000

All 2,175 programs on Self-hosted programs

Search and filter without leaving the page. Filters stay in the link, so you can share a view.

2,175 programs · Highest reward

  • Across Protocol

    across.to

    $1M

    from $250

    Scope
    3
    First response
    –
    Top severity
    Critical

  • Coinbase

    coinbase.com

    $1M

    from $1

    Scope
    2
    First response
    –
    Top severity
    –

    Safe harbor

  • Dapper Labs

    dapperlabs.com

    $1M
    Scope
    7
    First response
    –
    Top severity
    –

  • Safe

    safefoundation.org

    $1M
    Scope
    41
    First response
    –
    Top severity
    –

  • ChromeOS VRP

    google.com

    $500k

    from $250

    Scope
    3
    First response
    –
    Top severity
    Critical

  • Google Mobile VRP

    google.com

    $300k

    from $360

    Scope
    4
    First response
    –
    Top severity
    –

  • Meta Bug Bounty

    meta.com

    $300k

    from $500

    Scope
    28
    First response
    –
    Top severity
    –

  • ENS

    ens.domains

    $250k

    from $1,000

    Scope
    2
    First response
    –
    Top severity
    Critical

  • Glow

    glow.app

    $250k
    Scope
    6
    First response
    –
    Top severity
    –

  • Google Cloud VRP

    google.com

    $250k
    Scope
    6
    First response
    –
    Top severity
    –

  • szns

    szns.io

    $250k

    from $100

    Scope
    2
    First response
    –
    Top severity
    Critical

  • OHC

    onlinehashcrack.com

    $200k
    Scope
    3
    First response
    –
    Top severity
    –

  • Shopify

    shopify.com

    $200k
    Scope
    –
    First response
    –
    Top severity
    –

    Safe harbor

  • Flexa

    flexa.co

    $150k

    from $500

    Scope
    11
    First response
    –
    Top severity
    –

  • Probly

    probly.com

    USDC 100k

    from USDC 3,000

    Scope
    3
    First response
    –
    Top severity
    –

  • Proton

    proton.me

    $100k

    from $1,000

    Scope
    39
    First response
    –
    Top severity
    Critical

    Safe harbor

  • Telegram

    telegram.org

    $100k

    from $100

    Scope
    22
    First response
    –
    Top severity
    –

    Safe harbor

  • Trezor

    trezor.io

    $100k
    Scope
    5
    First response
    –
    Top severity
    Critical

  • Zircuit

    zircuit.com

    $100k

    from $5,000

    Scope
    3
    First response
    –
    Top severity
    –

  • Aragon

    aragon.org

    $50k
    Scope
    3
    First response
    –
    Top severity
    –

  • Auth0

    auth0.com

    $50k

    from $100

    Scope
    25
    First response
    –
    Top severity
    Critical

    Safe harbor

  • BlancVPN

    blancvpn.com

    $50k

    from $2,000

    Scope
    7
    First response
    –
    Top severity
    –

  • Stile

    stileapp.com

    $50k
    Scope
    2
    First response
    3 d
    Top severity
    –

  • Wagwalking

    wagwalking.com

    $50k
    Scope
    8
    First response
    3 d
    Top severity
    Critical

    Safe harbor

  • Polymesh

    polymesh.network

    $40k
    Scope
    3
    First response
    –
    Top severity
    –

  • Zora

    zora.co

    $40k
    Scope
    12
    First response
    –
    Top severity
    –

  • Braintree

    paypal.com

    $30k

    from $50

    Scope
    8
    First response
    2 d
    Top severity
    Critical

  • Decred

    decred.org

    $30k

    from $500

    Scope
    14
    First response
    –
    Top severity
    Critical

    No KYC

  • Synology

    synology.com

    $30k
    Scope
    36
    First response
    7 d
    Top severity
    –

  • HostAfrica

    hostafrica.com.gh

    $25k

    from $10k

    Scope
    10
    First response
    –
    Top severity
    –

  • Hostinger

    hostinger.com

    $25k

    from $100

    Scope
    10
    First response
    2 d
    Top severity
    –

  • Luel

    luel.ai

    $25k

    from $100

    Scope
    1
    First response
    –
    Top severity
    –

  • Obol Labs

    obol.org

    $25k

    from $125

    Scope
    19
    First response
    –
    Top severity
    Critical

  • CodeRabbit

    coderabbit.ai

    $20k

    from $100

    Scope
    3
    First response
    3 d
    Top severity
    Critical

    Safe harbor

  • Google AI VRP

    google.com

    $20k

    from $100

    Scope
    7
    First response
    –
    Top severity
    –

  • Mozilla Bug Bounty

    mozilla.org

    $20k

    from $3,000

    Scope
    –
    First response
    –
    Top severity
    –

    Safe harbor

  • Naver Bug Bounty

    naver.com

    $20k

    from $500

    Scope
    –
    First response
    –
    Top severity
    –

  • QNAP

    qnap.com

    $20k
    Scope
    41
    First response
    7 d
    Top severity
    –

    Safe harbor No KYC

  • Empire Flippers

    empireflippers.com

    $19.8k

    from $200

    Scope
    –
    First response
    –
    Top severity
    –