Bug bounty programs941

Atlas

Public programs on HackerOne, Bugcrowd, Intigriti and YesWeHack: scope, disclosed reports and subdomains.

Platform

In scope:Source code

Web applications751
Wildcard domains309
APIs133
Mobile apps332
Networks and IP ranges34
Source code66
Hardware and devices39
Desktop software45
AI models7
Other assets315

Has reports36

Bounty

Pays bounties42
No bounty24

Has subdomains35Clear filters66 of 941 programs

Bug bounty programs
Program	Platform	Bounty	Assets	Reports	Subdomains
Ruby on Rails	HackerOne	None	1	73	–
Ruby	HackerOne	Pays	1	73	–
Kubernetes	HackerOne	Pays	82	77	662
Coinbase	HackerOne	Pays	16	80	1,045
Valve	HackerOne	Pays	21	82	790
Concrete CMS	HackerOne	None	1	87	–
8x8	HackerOne	Pays	117	91	9,482
WordPress	HackerOne	Pays	23	96	29,502
Slack	HackerOne	Pays	19	133	137,436
Node.js	HackerOne	Pays	1	154	–
Weblate	HackerOne	None	6	157	36
Automattic	HackerOne	Pays	30	166	277
GitLab	HackerOne	Pays	19	257	786
Shopify	HackerOne	Pays	24	467	27,669
Nextcloud	HackerOne	Pays	94	613	1,642
curl	HackerOne	None	1	682	–

Programs and scope from each platform's public listing. Subdomains from ProjectDiscovery's Chaos dataset, still filling: 301 programs have them so far. Data as of 2026-11-15.