Checked
Find a bug bounty program
Paste a domain to see if it pays for bugs, or search 6,160 programs across 28 platforms.
Get paid to secure open source
475 paid open-source programs on Sorona, up to $1M
Perk
Low bugs: $100 or 1 month of Claude Max
Also on Patchstack. All 476 paid open-source programs
No program matches “”. Try the company's domain, like example.com.
- pay cash
- 2,849
- targets in scope
- 77,099
- changes this week
- 289
Fresh to hunt
View allPrograms launched and scope added in the last 30 days. New targets have had the fewest eyes on them.
-
FerreroNo cash
+1 in scope HackerOne · 1h ago
-
MirahezeNo cash
+2 in scope security.txt · 1h ago
-
dazn.comNo cash
+1 in scope security.txt · 1h ago
-
codeberg.orgNo cash
+4 in scope security.txt · 1h ago
-
expedia.comNo cash
+10 in scope security.txt · 1h ago
-
USA TODAY Co.No cash
+54 in scope security.txt · 1h ago
-
Immediate MediaNo cash
+2 in scope security.txt · 1h ago
-
News CorpNo cash
+5 in scope security.txt · 1h ago
Get paid to secure open source
The code is public, so you can read it before you test. Pick a project you already use, find a real bug, get paid.
Sorona
475 paid open-source programs
up to $1M
Perk
Low bugs: $100 or 1 month of Claude Max
-
Safe (Safe Smart Account) $1M
-
WebKit $300k
-
kvmCTF (Linux KVM hypervisor) $250k
-
Chromium $250k
-
V8 $250k
-
Chainlink node $101k
Highest paying
View allThe largest single reward each program publishes, shown in its own currency. Many web3 programs pay a share of funds at risk up to this cap.
| # | Program | Platform | Top severity | Top reward |
|---|---|---|---|---|
| 1 | Sherlock | Critical | $16,000,000 | |
| 2 | Cantina | Critical | $15,500,000 | |
| 3 | Immunefi | Critical | $10,000,000 | |
| 4 | Cantina | Critical | $10,000,000 | |
| 5 | Sherlock | Critical | $7,500,000 | |
| 6 | Immunefi | Critical | $6,000,000 | |
| 7 | Cantina | Critical | $5,000,000 | |
| 8 | Self-hosted | $5,000,000 | ||
| 9 | Immunefi | Critical | $5,000,000 | |
| 10 | Immunefi | Critical | $5,000,000 |
Recent changes
View allRewards, scope and status. Cuts, removals and closures are confirmed on two checks first.
-
Paused Intigriti
Paused. Not accepting reports right now.
-
Scope + HackerOne
Added to scope: ferrero.integrityline.app
-
Scope + security.txt
Added to scope: blueridgenow.com
-
Scope + security.txt
Added to scope: burlingtoncountytimes.com
-
Scope + security.txt
Added to scope: amestrib.com
-
Scope + security.txt
Added to scope: battlecreekenquirer.com
-
Scope + security.txt
Added to scope: dnj.com
Top self-hosted programs
View allCompanies that pay for bugs on their own site, no platform account needed.
-
Apple Security Bounty$5M
apple.com
-
Android and Google Devices Security Rewards$1.5M
google.com
-
Samsung Mobile Security Rewards$1M
samsungmobile.com
-
Ethereum Foundation Bug Bounty$1M
ethereum.org
-
State Voices Florida$1M
statevoicesfl.org
-
Safe$1M
safefoundation.org
-
Dapper Labs$1M
dapperlabs.com
-
Across Protocol$1M
across.to
-
Coinbase$1M
coinbase.com
-
ChromeOS VRP$500k
google.com
Top bug bounty platforms
Compare allRanked by public programs open right now.
-
1
Sorona 475 pay cash 475 open
-
2
HackerOne 220 pay cash 452 open
-
3
Bugcrowd 291 pay cash 296 open
-
4
HackenProof 155 pay cash 157 open
-
5
Immunefi 145 pay cash 146 open
-
6
Intigriti 68 pay cash 145 open
-
7
Standoff 365 89 pay cash 89 open
-
8
YesWeHack 51 pay cash 53 open
-
9
BugRap 50 pay cash 51 open
-
10
Cantina 48 pay cash 48 open
-
11
Sherlock 37 pay cash 37 open
-
12
Remedy 36 pay cash 37 open