Bug bounty programs940
Public programs on HackerOne, Bugcrowd, Intigriti and YesWeHack: scope, disclosed reports and subdomains.
| Program | Platform | Bounty | Assets | Reports | Subdomains |
|---|---|---|---|---|---|
| Version Cake | HackerOne | None | 1 | – | – |
| TRON DAO | HackerOne | Pays | 1 | – | – |
| Omarchy | HackerOne | Pays | 1 | – | – |
| DefectDojo | HackerOne | None | 1 | – | – |
| Solidus | HackerOne | None | 2 | – | – |
| Arc | HackerOne | Pays | 6 | – | – |
| Airtable | HackerOne | Pays | 7 | – | 611 |
| Supabase | HackerOne | None | 8 | – | – |
| Redis VDP | HackerOne | None | 8 | – | 4,147 |
| Chia Network | HackerOne | Pays | 9 | – | – |
| OKG | HackerOne | Pays | 10 | – | 237 |
| DailyPay VDP | HackerOne | None | 10 | – | – |
| Matomo | HackerOne | Pays | 11 | – | 2,014 |
| Privy (Bounty) | HackerOne | Pays | 12 | – | – |
| Plaid | HackerOne | Pays | 12 | – | 307 |
| Oasis Protocol Foundation | HackerOne | Pays | 13 | – | – |
| Anthropic | HackerOne | Pays | 14 | – | – |
| 1win | HackerOne | Pays | 14 | – | – |
| PagerDuty | HackerOne | None | 18 | – | 1,564 |
| GoCardless Bug Bounty Program | HackerOne | Pays | 18 | – | – |
| Nebius AI Vulnerability Disclosure | HackerOne | None | 21 | – | – |
| MoonPay | HackerOne | Pays | 21 | – | 246 |
| Circle | HackerOne | Pays | 22 | – | 307 |
| Ripio | HackerOne | Pays | 24 | – | – |
| Crypto.com | HackerOne | Pays | 24 | – | 228 |
| Netflix | HackerOne | Pays | 30 | – | 221,723 |
| Global Payments | HackerOne | None | 43 | – | – |
| Spotify | HackerOne | Pays | 45 | – | – |
| Twilio | HackerOne | Pays | 83 | – | 4,137 |
| Epic Games VDP | HackerOne | None | 91 | – | 34,455 |
| Chainlink | HackerOne | Pays | 8 | 2 | 420 |
| Exodus | HackerOne | Pays | 28 | 3 | 202 |
| Tools for Humanity | HackerOne | Pays | 22 | 4 | – |
| OpenMage | HackerOne | None | 3 | 5 | 7 |
| WHO COVID-19 Mobile App | HackerOne | None | 5 | 7 | – |
| Central Security Project | HackerOne | None | 3 | 8 | 36 |
| TomTom | HackerOne | None | 4 | 8 | 40,876 |
| U.S. Department of State | HackerOne | None | 24 | 9 | – |
| Bitwarden | HackerOne | None | 21 | 11 | 77 |
| Doppler | HackerOne | Pays | 6 | 12 | – |
| Deriv.com | HackerOne | Pays | 18 | 12 | – |
| DuckDuckGo | HackerOne | None | 4 | 16 | 765 |
| Vercel | HackerOne | Pays | 26 | 16 | 1,259 |
| Discourse | HackerOne | Pays | 2 | 21 | – |
| Snapchat | HackerOne | Pays | 40 | 37 | 1,681 |
| Cloudflare Public Bug Bounty | HackerOne | Pays | 51 | 44 | 24,298 |
| Basecamp | HackerOne | Pays | 17 | 57 | – |
| Revive Adserver | HackerOne | None | 1 | 61 | – |
| MariaDB | HackerOne | None | 5 | 61 | 67 |
| AWS VDP | HackerOne | None | 555 | 61 | 3,037 |
Programs and scope from each platform's public listing. Subdomains from ProjectDiscovery's Chaos dataset, still filling: 301 programs have them so far. Data as of 2026-11-15.