Bug bounty programs941
Public programs on HackerOne, Bugcrowd, Intigriti and YesWeHack: scope, disclosed reports and subdomains.
| Program | Platform | Bounty | Assets | Reports | Subdomains |
|---|---|---|---|---|---|
| curl | HackerOne | None | 1 | 682 | – |
| Nextcloud | HackerOne | Pays | 94 | 613 | 1,642 |
| Shopify | HackerOne | Pays | 24 | 467 | 27,669 |
| GitLab | HackerOne | Pays | 19 | 257 | 786 |
| Automattic | HackerOne | Pays | 30 | 166 | 277 |
| Weblate | HackerOne | None | 6 | 157 | 36 |
| Node.js | HackerOne | Pays | 1 | 154 | – |
| Slack | HackerOne | Pays | 19 | 133 | 137,436 |
| WordPress | HackerOne | Pays | 23 | 96 | 29,502 |
| 8x8 | HackerOne | Pays | 117 | 91 | 9,482 |
| Concrete CMS | HackerOne | None | 1 | 87 | – |
| Valve | HackerOne | Pays | 21 | 82 | 790 |
| Coinbase | HackerOne | Pays | 16 | 80 | 1,045 |
| Kubernetes | HackerOne | Pays | 82 | 77 | 662 |
| Ruby | HackerOne | Pays | 1 | 73 | – |
| Ruby on Rails | HackerOne | None | 1 | 73 | – |
| AWS VDP | HackerOne | None | 555 | 61 | 3,037 |
| MariaDB | HackerOne | None | 5 | 61 | 67 |
| Revive Adserver | HackerOne | None | 1 | 61 | – |
| Basecamp | HackerOne | Pays | 17 | 57 | – |
| Cloudflare Public Bug Bounty | HackerOne | Pays | 51 | 44 | 24,298 |
| Snapchat | HackerOne | Pays | 40 | 37 | 1,681 |
| Discourse | HackerOne | Pays | 2 | 21 | – |
| Vercel | HackerOne | Pays | 26 | 16 | 1,259 |
| DuckDuckGo | HackerOne | None | 4 | 16 | 765 |
| Deriv.com | HackerOne | Pays | 18 | 12 | – |
| Doppler | HackerOne | Pays | 6 | 12 | – |
| Bitwarden | HackerOne | None | 21 | 11 | 77 |
| U.S. Department of State | HackerOne | None | 24 | 9 | – |
| TomTom | HackerOne | None | 4 | 8 | 40,876 |
| Central Security Project | HackerOne | None | 3 | 8 | 36 |
| WHO COVID-19 Mobile App | HackerOne | None | 5 | 7 | – |
| OpenMage | HackerOne | None | 3 | 5 | 7 |
| Tools for Humanity | HackerOne | Pays | 22 | 4 | – |
| Exodus | HackerOne | Pays | 28 | 3 | 202 |
| Chainlink | HackerOne | Pays | 8 | 2 | 420 |
Programs and scope from each platform's public listing. Subdomains from ProjectDiscovery's Chaos dataset, still filling: 301 programs have them so far. Data as of 2026-11-15.