Bug bounty programs: the complete guide.

Pick a program whose policy is current, whose scope covers technology you know, and that offers full or partial safe harbor. Start with disclosure programs or smaller paying programs to build a track record, read the scope twice, and report only what you can prove.

A standing offer from an organisation to reward security researchers who find and responsibly report vulnerabilities in its systems, under a published policy and scope.

Both accept reports from the public. A bug bounty pays rewards for valid findings; a VDP gives a safe, legal reporting channel but usually no cash.

Our list tracks every program in the disclose.io open database — more than 1,600 public bounty and disclosure programs, with sub-domains that share one policy folded into a single entry. A few hundred of them state that they pay rewards.

Programs with broad scope, clear rules and full safe harbor, including disclosure programs that credit researchers in a hall of fame. Fewer hunters compete there, so first findings come sooner.

A program's promise not to take legal action against researchers who follow its policy in good faith. Full safe harbor covers anti-hacking and anti-circumvention laws; partial covers only some of them.

Testing within a program's published policy and scope is authorised by that program. Testing outside scope, or a system with no policy, can break computer-misuse laws. This is general information, not legal advice.

A standard file (RFC 9116) at /.well-known/security.txt that lists where to report vulnerabilities. If an organisation has no program, security.txt is the next place to look.

A public page where an organisation credits researchers by name or handle for valid reports — verifiable proof of your work.

Merchandise, such as t-shirts or stickers, sent as thanks for valid reports instead of or alongside cash.

Read the policy, stay in scope, avoid accessing other people's data, stop once you can prove impact, and submit clear steps, impact and a minimal proof of concept through the program's channel.

A clear title, affected asset, severity and impact, exact reproduction steps, a minimal proof of concept and a suggested fix.

It depends on the program, the severity of what you find and how often you find it. Each paying program publishes its own reward range.

Only when the program's policy allows it, usually after a fix and an agreed timeline. Always agree disclosure with the program first.

Look for a security.txt file or a security contact. If there is no policy, testing is not authorised — report only what you observed without active testing.

The disclose.io open database, a public-domain (CC0) community record of disclosure policies. Corrections can be submitted to disclose.io.

We refresh our copy from disclose.io regularly; each page shows the snapshot month so you know how current it is.

The list helps anyone find public programs. BugsBounty.com itself runs private and public programs with vetted researchers who hack with AutoVAPT AI, the autonomous pentesting engine from AutoVAPT.ai.

Apply with your experience and links. Registration is by approval; you may be asked to complete a CTF. Approved researchers receive their registration link by email.