Bug bounty programs942
Public programs on HackerOne, Bugcrowd, Intigriti and YesWeHack: scope, disclosed reports and subdomains.
| Program | Platform | Bounty | Assets | Reports | Subdomains |
|---|---|---|---|---|---|
| U.S. Dept Of Defense | HackerOne | None | – | 884 | – |
| curl | HackerOne | None | 1 | 682 | – |
| Weblate | HackerOne | None | 6 | 157 | 36 |
| MTN Group | HackerOne | None | 498 | 128 | 214,283 |
| Concrete CMS | HackerOne | None | 1 | 87 | – |
| Monero | HackerOne | None | – | 82 | – |
| Ruby on Rails | HackerOne | None | 1 | 73 | – |
| Stripo Inc | HackerOne | None | 2 | 72 | 108 |
| Khan Academy | HackerOne | None | – | 71 | 382 |
| Mars | HackerOne | None | 113 | 68 | 3,528 |
| Informatica | HackerOne | None | 5 | 68 | 1,177 |
| WakaTime | HackerOne | None | 1 | 63 | – |
| AWS VDP | HackerOne | None | 555 | 61 | 3,036 |
| MariaDB | HackerOne | None | 5 | 61 | 67 |
| Revive Adserver | HackerOne | None | 1 | 61 | – |
| IBM | HackerOne | None | 3 | 48 | 104,391 |
| General Motors | HackerOne | None | – | 18 | – |
| DuckDuckGo | HackerOne | None | 4 | 16 | 765 |
| OWOX, Inc. | HackerOne | None | – | 16 | – |
| lemlist | HackerOne | None | 5 | 14 | 91 |
| Autodesk | HackerOne | None | 1 | 14 | – |
| Sony | HackerOne | None | 1 | 14 | 13,535 |
| Bitwarden | HackerOne | None | 21 | 11 | 77 |
| SingleStore | HackerOne | None | 14 | 10 | – |
| Dust | HackerOne | None | 2 | 10 | – |
| Stellar.org | HackerOne | None | – | 10 | – |
| U.S. Department of State | HackerOne | None | 24 | 9 | – |
| Palo Alto Software | HackerOne | None | 4 | 9 | 2,377 |
| TomTom | HackerOne | None | 4 | 8 | 40,827 |
| Central Security Project | HackerOne | None | 3 | 8 | 36 |
| Equifax-vdp | HackerOne | None | 283 | 7 | 55,670 |
| JetBlue | HackerOne | None | 16 | 7 | 938 |
| Tucows (VDP) | HackerOne | None | 11 | 7 | – |
| Lovable VDP | HackerOne | None | 5 | 7 | – |
| WHO COVID-19 Mobile App | HackerOne | None | 5 | 7 | – |
| FormAssembly | HackerOne | None | 7 | 6 | – |
| Top Echelon Software | HackerOne | None | 3 | 6 | 113 |
| Coursera | HackerOne | None | 1 | 6 | 308 |
| arkadiyt-projects | HackerOne | None | – | 6 | – |
| Essity | HackerOne | None | 481 | 5 | – |
| Trellix | HackerOne | None | 6 | 5 | 4,968 |
| Myndr | HackerOne | None | 3 | 5 | 102 |
| OpenMage | HackerOne | None | 3 | 5 | 7 |
| Staging.every.org | HackerOne | None | 1 | 5 | 49 |
| Nutanix | HackerOne | None | 17 | 4 | 4,022 |
| Alohi | HackerOne | None | 10 | 4 | 88 |
| Fastly VDP | HackerOne | None | 6 | 4 | 46 |
| UPS VDP | HackerOne | None | 3 | 3 | – |
| PUBG | HackerOne | None | 2 | 3 | 132 |
| R3 | HackerOne | None | 1 | 3 | – |
Programs and scope from each platform's public listing. Subdomains from ProjectDiscovery's Chaos dataset, still filling: 299 programs have them so far. Data as of 2026-11-14.