BugsBounty lion shieldBugsBounty.com

[ DB ] — Program directory

Every public bug bounty program, in one list.

Find who accepts reports, who pays, and who promises not to sue. Search by name, filter by what matters to you, then read the policy before you test.

Apply to joinHow to pick a program
Programs
1,613
Pay bounties
433
Full safe harbor
296

What is a bug bounty program list?

A bug bounty program list is a directory of organisations that publicly accept vulnerability reports. For each program it shows whether rewards are paid, whether swag or hall-of-fame credit is offered, and how much legal safe harbor researchers get, so hunters can pick targets that respect good-faith research.

Page 1 of 17 · 0–9–A

100 shown

Data from the disclose.io open database (CC0 public domain), snapshot November 2026. A dash means the program hasn't stated it. Policies change — always read a program's own policy and scope before testing.

Browse A–Z

0–9ABCDEFGHIJKLMNOPQRSTUVWXYZ

Browse by what matters

[ FAQ ] — Questions people ask

What is a bug bounty program list?

+

A bug bounty program list is a directory of organisations that publicly accept vulnerability reports. For each program it shows whether rewards are paid, whether swag or hall-of-fame credit is offered, and how much legal safe harbor researchers get, so hunters can pick targets that respect good-faith research.

What does safe harbor mean in a bug bounty program?

+

Safe harbor is the program's promise not to take legal action against researchers who follow its policy in good faith. Full safe harbor covers anti-hacking and copyright laws; partial safe harbor covers only some of them.

Where does this list come from?

+

The list is built from the disclose.io open database, a public-domain, community-maintained record of vulnerability disclosure policies. Corrections can be submitted to disclose.io.

Do all programs on the list pay rewards?

+

No. Many are vulnerability disclosure programs that accept reports without paying. Use the 'Pays bounty' filter to see only programs that offer cash rewards.

Should I test a program before reading its policy?

+

No. Always read the program's policy and scope first. Testing outside scope, or without a published policy, can expose you to legal risk.