Public bug bounty programs

Every public bug bounty and vulnerability disclosure program we track, with what it pays, what is in scope and how fast it answers.

6,160 programs on 28 platforms · Updated 12 Nov 2026, 21:22 UTC

Sort

Filters

641 programs match · Highest reward

Programs, highest reward first
Program	Platform	Scope	First response	Top reward
Apple Security Bounty apple.com	Self-hosted	3	–	$5,000,000
Android and Google Devices Security Rewards google.com	Self-hosted	8	–	$1,500,000
Across Protocol across.to	Self-hosted	3	–	$1,000,000 from $250
Coinbase coinbase.com	Self-hosted	2	–	$1,000,000 from $1
Dapper Labs dapperlabs.com	Self-hosted	7	–	$1,000,000
Ethereum Foundation Bug Bounty ethereum.org	Self-hosted	34	7 d	$1,000,000 from $2,000
Safe safefoundation.org	Self-hosted	41	–	$1,000,000
Samsung Mobile Security Rewards samsungmobile.com	Self-hosted	8	–	$1,000,000 from $200
State Voices Florida statevoicesfl.org	Self-hosted	1	–	$1,000,000
ChromeOS VRP google.com	Self-hosted	3	–	$500,000 from $250
Google Mobile VRP google.com	Self-hosted	4	–	$300,000 from $360
Meta Bug Bounty meta.com	Self-hosted	28	–	$300,000 from $500
Chrome Vulnerability Rewards google.com	Self-hosted	6	–	$250,128 from $1,000
ENS ens.domains	Self-hosted	2	–	$250,000 from $1,000
Glow glow.app	Self-hosted	6	–	$250,000
Google Cloud VRP google.com	Self-hosted	6	–	$250,000
Microsoft Bounty Program microsoft.com	Self-hosted	11	–	$250,000
szns szns.io	Self-hosted	2	–	$250,000 from $100
OHC onlinehashcrack.com	Self-hosted	3	–	$200,000
Shopify shopify.com	Self-hosted	–	–	$200,000
Flexa flexa.co	Self-hosted	11	–	$150,000 from $500
Google and Alphabet VRP google.com	Self-hosted	26	–	$101,010 from $100
Probly probly.com	Self-hosted	3	–	USDC 100,000 from USDC 3,000
Proton proton.me	Self-hosted	39	–	$100,000 from $1,000
Telegram telegram.org	Self-hosted	22	–	$100,000 from $100
Trezor trezor.io	Self-hosted	5	–	$100,000
Zircuit zircuit.com	Self-hosted	3	–	$100,000 from $5,000
Aragon aragon.org	Self-hosted	3	–	$50,000
Auth0 auth0.com	Self-hosted	25	–	$50,000 from $100
BlancVPN blancvpn.com	Self-hosted	7	–	$50,000 from $2,000
Stile stileapp.com	Self-hosted	2	3 d	$50,000
Wagwalking wagwalking.com	Self-hosted	8	3 d	$50,000
Polymesh polymesh.network	Self-hosted	3	–	$40,000
Zora zora.co	Self-hosted	12	–	$40,000
Google Open Source Software VRP google.com	Self-hosted	5	–	$31,337 from $500
Braintree paypal.com	Self-hosted	8	2 d	$30,000 from $50
Decred decred.org	Self-hosted	14	–	$30,000 from $500
Synology synology.com	Self-hosted	36	7 d	$30,000
HostAfrica hostafrica.com.gh	Self-hosted	10	–	$25,000 from $10k
Hostinger hostinger.com	Self-hosted	10	2 d	$25,000 from $100
Luel luel.ai	Self-hosted	1	–	$25,000 from $100
Obol Labs obol.org	Self-hosted	19	–	$25,000 from $125
Ubiquiti - Aside program to the current at HackerOne ui.com	Self-hosted	11	–	$25,000 from $100
CodeRabbit coderabbit.ai	Self-hosted	3	3 d	$20,000 from $100
Google AI VRP google.com	Self-hosted	7	–	$20,000 from $100
Mozilla Bug Bounty mozilla.org	Self-hosted	–	–	$20,000 from $3,000
Naver Bug Bounty naver.com	Self-hosted	–	–	$20,000 from $500
QNAP qnap.com	Self-hosted	41	7 d	$20,000
Empire Flippers empireflippers.com	Self-hosted	–	–	$19,750 from $200
Google Patch Rewards google.com	Self-hosted	5	–	$15,000 from $100

Apple Security Bounty

Self-hosted · apple.com

$5M

Scope

3

First response

–

Top severity

–
Android and Google Devices Security Rewards

Self-hosted · google.com

$1.5M

Scope

8

First response

–

Top severity

–
Across Protocol

Self-hosted · across.to

$1M
from $250

Scope

3

First response

–

Top severity

Critical
Coinbase

Self-hosted · coinbase.com

$1M
from $1

Scope

2

First response

–

Top severity

–

Safe harbor
Dapper Labs

Self-hosted · dapperlabs.com

$1M

Scope

7

First response

–

Top severity

–
Ethereum Foundation Bug Bounty

Self-hosted · ethereum.org

$1M
from $2,000

Scope

34

First response

7 d

Top severity

–
Safe

Self-hosted · safefoundation.org

$1M

Scope

41

First response

–

Top severity

–
Samsung Mobile Security Rewards

Self-hosted · samsungmobile.com

$1M
from $200

Scope

8

First response

–

Top severity

–
State Voices Florida

Self-hosted · statevoicesfl.org

$1M

Scope

1

First response

–

Top severity

–
ChromeOS VRP

Self-hosted · google.com

$500k
from $250

Scope

3

First response

–

Top severity

Critical
Google Mobile VRP

Self-hosted · google.com

$300k
from $360

Scope

4

First response

–

Top severity

–
Meta Bug Bounty

Self-hosted · meta.com

$300k
from $500

Scope

28

First response

–

Top severity

–
Chrome Vulnerability Rewards

Self-hosted · google.com

$250.1k
from $1,000

Scope

6

First response

–

Top severity

–
ENS

Self-hosted · ens.domains

$250k
from $1,000

Scope

2

First response

–

Top severity

Critical
Glow

Self-hosted · glow.app

$250k

Scope

6

First response

–

Top severity

–
Google Cloud VRP

Self-hosted · google.com

$250k

Scope

6

First response

–

Top severity

–
Microsoft Bounty Program

Self-hosted · microsoft.com

$250k

Scope

11

First response

–

Top severity

–

Safe harbor
szns

Self-hosted · szns.io

$250k
from $100

Scope

2

First response

–

Top severity

Critical
OHC

Self-hosted · onlinehashcrack.com

$200k

Scope

3

First response

–

Top severity

–
Shopify

Self-hosted · shopify.com

$200k

Scope

–

First response

–

Top severity

–

Safe harbor
Flexa

Self-hosted · flexa.co

$150k
from $500

Scope

11

First response

–

Top severity

–
Google and Alphabet VRP

Self-hosted · google.com

$101k
from $100

Scope

26

First response

–

Top severity

–
Probly

Self-hosted · probly.com

USDC 100k
from USDC 3,000

Scope

3

First response

–

Top severity

–
Proton

Self-hosted · proton.me

$100k
from $1,000

Scope

39

First response

–

Top severity

Critical

Safe harbor
Telegram

Self-hosted · telegram.org

$100k
from $100

Scope

22

First response

–

Top severity

–

Safe harbor
Trezor

Self-hosted · trezor.io

$100k

Scope

5

First response

–

Top severity

Critical
Zircuit

Self-hosted · zircuit.com

$100k
from $5,000

Scope

3

First response

–

Top severity

–
Aragon

Self-hosted · aragon.org

$50k

Scope

3

First response

–

Top severity

–
Auth0

Self-hosted · auth0.com

$50k
from $100

Scope

25

First response

–

Top severity

Critical

Safe harbor
BlancVPN

Self-hosted · blancvpn.com

$50k
from $2,000

Scope

7

First response

–

Top severity

–
Stile

Self-hosted · stileapp.com

$50k

Scope

2

First response

3 d

Top severity

–
Wagwalking

Self-hosted · wagwalking.com

$50k

Scope

8

First response

3 d

Top severity

Critical

Safe harbor
Polymesh

Self-hosted · polymesh.network

$40k

Scope

3

First response

–

Top severity

–
Zora

Self-hosted · zora.co

$40k

Scope

12

First response

–

Top severity

–
Google Open Source Software VRP

Self-hosted · google.com

$31.3k
from $500

Scope

5

First response

–

Top severity

–
Braintree

Self-hosted · paypal.com

$30k
from $50

Scope

8

First response

2 d

Top severity

Critical
Decred

Self-hosted · decred.org

$30k
from $500

Scope

14

First response

–

Top severity

Critical

No KYC
Synology

Self-hosted · synology.com

$30k

Scope

36

First response

7 d

Top severity

–
HostAfrica

Self-hosted · hostafrica.com.gh

$25k
from $10k

Scope

10

First response

–

Top severity

–
Hostinger

Self-hosted · hostinger.com

$25k
from $100

Scope

10

First response

2 d

Top severity

–
Luel

Self-hosted · luel.ai

$25k
from $100

Scope

1

First response

–

Top severity

–
Obol Labs

Self-hosted · obol.org

$25k
from $125

Scope

19

First response

–

Top severity

Critical
Ubiquiti - Aside program to the current at HackerOne

Self-hosted · ui.com

$25k
from $100

Scope

11

First response

–

Top severity

–
CodeRabbit

Self-hosted · coderabbit.ai

$20k
from $100

Scope

3

First response

3 d

Top severity

Critical

Safe harbor
Google AI VRP

Self-hosted · google.com

$20k
from $100

Scope

7

First response

–

Top severity

–
Mozilla Bug Bounty

Self-hosted · mozilla.org

$20k
from $3,000

Scope

–

First response

–

Top severity

–

Safe harbor
Naver Bug Bounty

Self-hosted · naver.com

$20k
from $500

Scope

–

First response

–

Top severity

–
QNAP

Self-hosted · qnap.com

$20k

Scope

41

First response

7 d

Top severity

–

Safe harbor No KYC
Empire Flippers

Self-hosted · empireflippers.com

$19.8k
from $200

Scope

–

First response

–

Top severity

–
Google Patch Rewards

Self-hosted · google.com

$15k
from $100

Scope

5

First response

–

Top severity

–