Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

BTSE Bug Bounty Program

By BTSE Bug bounty on HackenProof btse.com

Accepting reports KYC to get paid CEX Web apps
Go to program
Top reward
$3,000
Top severity paid
Critical
Assets in scope
4
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

Pays up to $3,000
for critical bugs.
Report on HackenProof
Submit through the program page.
Replies within 3 days
As the policy promises.
Paid by USDT
Proof of identity needed to get paid.
Publish after a fix
Coordinate the timing with the company.

Rewards

What HackenProof lists as the payout for each severity.

Severity Reward
Critical $3,000
Response
Within 3 days First Response 3d
Hall of fame
Yes @zxwo KYC 1

Summarised with AI from the program policy on HackenProof, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

4 assets you may test, 2 excluded.

Android apps 1

  • https://play.google.com/store/apps/details?id=com.btse.finance

APIs 1

  • https://api.btse.com

iOS apps 1

  • https://apps.apple.com/ng/app/btse/id1494556510

Web 1

  • https://www.btse.com
Out of scope (2)
  • https://blog.btse.com
  • https://support.btse.com

Rules

What the policy asks of you, and the bug types it won't reward, quoted from BTSE Bug Bounty Program (via HackenProof)'s policy. "We" in these lines means the program, not this site.

While testing

  • Provide our Technical Support team reasonable turnaround time to resolve the issue before any public or third-party disclosure
  • Do not compromise any personal data, avoid interruptions or degradation of any service; Never access or modify other users’ data; Localize all tests to your personal accounts only
  • Ensure all efforts taken shall not damage or restrict the availability of BTSE’s products, services or infrastructure
  • Any and all details of found vulnerabilities must only be communicated to the BTSE Team and its Management
  • Only vulnerability reports with detailed, reproducible steps, and PoC video will be eligible for a reward
  • Avoid using web application scanners for automatic vulnerability searches which generates massive traffic
  • Do not exploit any DoS/DDoS vulnerabilities, social engineering attacks or spam
  • Do not spam forms or account creation flows using automated scanners
  • In case chain vulnerabilities is reported, BTSE will reward the vulnerability with the highest severity
  • In cases where duplicates occur, reward will only be given to the first report with complete details

Not accepted

  • Theoretical vulnerabilities without actual proof of concept
  • Email verification deficiencies, expiration of password reset links, and password complexity policies
  • Invalid or missing SPF (Sender Policy Framework) records (incomplete or missing SPF/DKIM/DMARC)
  • Clickjacking/UI redressing with minimal security impact
  • Email or mobile enumeration (E.g. the ability to identify emails via password reset)
  • Information disclosure with minimal security impact (E.g. stack traces, path disclosure, directory listings, logs)
  • Internally known issues, duplicate issues, or issues which have already been made public
  • Tab-nabbing
  • Self-XSS
  • Vulnerabilities only exploitable on out-of-date browsers or platforms
  • Vulnerabilities related to auto-fill web forms
  • Use of known vulnerable libraries without actual proof of concept
  • Issues related to unsafe SSL/TLS cipher suites or protocol version
  • Content spoofing
  • Cache-control related issues
  • Exposure of internal IP address or domains
  • Missing security headers that do not lead to direct exploitation
  • CSRF with negligible security impact (E.g. adding to favourites, adding to cart, subscribing to a non critical feature)
  • Vulnerabilities that require physical access to a user's device
  • Issues that have no security impact (E.g. Failure to load a web page)
  • Any activity (like DoS/DDoS) that disrupts our services
  • Reports from automated tools or scans

Summarised with AI from the program policy on HackenProof, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 8 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from hackenproof.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Bug bounty Triaged by HackenProof BTSE Bug Bounty Program: Program info BTSE Bug Bounty Program Company: BTSE Scope Review: 1079819 Submissions: 331 Total rewards: $8,100 Reputation 100 points required PoC Required Program is: active now Live Submit report Program info Hackers 138 Reports 0 The BTSE bug bounty program offers rewards to security researchers and enthusiasts who help us identify and resolve potential vulnerabilities within the BTSE system. All Scope Ineligible Issues (Issues considered as out of scope) Disclosure Policy and Program Rules Terms Scope Search targets In scope Target │ Type │ Severity https://www.btse.com Copy https://www.btse.com │ Web │ Critical https://api.btse.com Copy https://api.btse.com │ API │ Critical https://play.google.com/store/apps/details?id=com.btse.finance Copy https://play.google.com/store/apps/details?id=com.btse.finance │ Android │ Critical https://apps.apple.com/ng/app/btse/id1494556510 Copy https://apps.apple.com/ng/app/btse/id1494556510 │ iOS │ Critical Out of scope Out of scope Target │ Type │ Severity https://support.btse.com Copy Web │ None https://blog.btse.com Copy Web │ None Ineligible Issues (Issues considered as out of scope) • Theoretical vulnerabilities without actual proof of concept • Email verification deficiencies, expiration of password reset links, and password complexity policies • Invalid or missing SPF (Sender Policy Framework) records (incomplete or missing SPF/DKIM/DMARC) • Clickjacking/UI redressing with minimal security impact • Email or mobile enumeration (E.g. the ability to identify emails via password reset) • Information disclosure with minimal security impact (E.g. stack traces, path disclosure, directory listings, logs) • Internally known issues, duplicate issues, or issues which have already been made public • Tab-nabbing • Self-XSS • Vulnerabilities only exploitable on out-of-date browsers or platforms • Vulnerabilities related to auto-fill web forms • Use of known vulnerable libraries without actual proof of concept • Issues related to unsafe SSL/TLS cipher suites or protocol version • Content spoofing • Cache-control related issues • Exposure of internal IP address or domains • Missing security headers that do not lead to direct exploitation • CSRF with negligible security impact (E.g. adding to favourites, adding to cart, subscribing to a non critical feature) • Vulnerabilities that require physical access to a user's device • Issues that have no security impact (E.g. Failure to load a web page) • Any activity (like DoS/DDoS) that disrupts our services • Reports from automated tools or scans Disclosure Policy and Program Rules • Provide our Technical Support team reasonable turnaround time to resolve the issue before any public or third-party disclosure • Do not compromise any personal data, avoid interruptions or degradation of any service; Never access or modify other users’ data; Localize all tests to your personal accounts only • Ensure all efforts taken shall not damage or restrict the availability of BTSE’s products, services or infrastructure • Any and all details of found vulnerabilities must only be communicated to the BTSE Team and its Management • Only vulnerability reports with detailed, reproducible steps, and PoC video will be eligible for a reward • Avoid using web application scanners for automatic vulnerability searches which generates massive traffic • Do not exploit any DoS/DDoS vulnerabilities, social engineering attacks or spam • Do not spam forms or account creation flows using automated scanners • In case chain vulnerabilities is reported, BTSE will reward the vulnerability with the highest severity • In cases where duplicates occur, reward will only be given to the first report with complete details • Do not break any applicable and related Laws, breach of any will render your claim invalid Terms • BTSE reserves the right to cancel or amend the bounty or bounty rules at our sole discretion. • Rewards will be issued within 3 weeks after the vulnerability report is verified. • Rewards will be paid out in USDT by the platform. • BTSE will only reward the first verified report of a vulnerability; similar reports that are submitted will no longer be rewarded. Live since 05 Nov 2021 Published date 05 Nov 2021 Last updated 06 Nov 2026 Range of bounty $100 - $3,000 Severity Critical $2,000 - $3,000 High $700 - $1,500 Medium $300 - $500 Low $100 - $200 CEX apps Web @zxwo KYC 1 @dglabz KYC 2 @cyberarmy101 KYC Verified 3 @geekranjeet Verified 4 @IsmayilovSabuhi 5 Response type Business days First Response 3d Triage Time 3d Reward Time 7d Resolution Time 14d