Bug bounty programs940
Public programs on HackerOne, Bugcrowd, Intigriti and YesWeHack: scope, disclosed reports and subdomains.
| Program | Platform | Bounty | Assets | Reports | Subdomains |
|---|---|---|---|---|---|
| Penn Entertainment | HackerOne | None | 11 | – | – |
| OakNorth Bank | HackerOne | None | 11 | – | – |
| NISC-VDP | HackerOne | None | 11 | – | – |
| Matomo | HackerOne | Pays | 11 | – | 2,014 |
| M&T Bank Vulnerability Disclosure | HackerOne | None | 11 | – | – |
| KOHO | HackerOne | Pays | 11 | – | 162 |
| Inspectorio | HackerOne | Pays | 11 | – | – |
| Hack The Box | HackerOne | None | 11 | – | – |
| Wolt | HackerOne | Pays | 12 | – | – |
| Starling Bank VDP | HackerOne | None | 12 | – | 48 |
| Privy (Bounty) | HackerOne | Pays | 12 | – | – |
| Plaid | HackerOne | Pays | 12 | – | 307 |
| Meesho | HackerOne | Pays | 12 | – | – |
| GetYourGuide VDP | HackerOne | None | 12 | – | – |
| Faraday, Inc. | HackerOne | Pays | 12 | – | – |
| Box BB | HackerOne | Pays | 12 | – | – |
| Bose (VDP) | HackerOne | None | 12 | – | – |
| Wickr | HackerOne | Pays | 13 | – | 54 |
| Via | HackerOne | Pays | 13 | – | – |
| PhonePe | HackerOne | None | 13 | – | – |
| Oasis Protocol Foundation | HackerOne | Pays | 13 | – | – |
| Notion Labs, Inc. | HackerOne | Pays | 13 | – | – |
| KHealth | HackerOne | Pays | 13 | – | – |
| Aeromexico VDP | HackerOne | None | 13 | – | – |
| XP Inc Vulnerability Disclosure | HackerOne | None | 14 | – | – |
| Wells Fargo Bounty | HackerOne | Pays | 14 | – | 15,819 |
| Truist Financial | HackerOne | None | 14 | – | – |
| Paystack Vulnerability Disclosure | HackerOne | None | 14 | – | – |
| Hyland Software | HackerOne | None | 14 | – | – |
| Credit Karma | HackerOne | Pays | 14 | – | 1,196 |
| Costco | HackerOne | None | 14 | – | 2,511 |
| Bybit Fintech Ltd | HackerOne | Pays | 14 | – | – |
| Avalara | HackerOne | None | 14 | – | 3,938 |
| Anthropic | HackerOne | Pays | 14 | – | – |
| 3CX | HackerOne | Pays | 14 | – | – |
| 1win | HackerOne | Pays | 14 | – | – |
| Tenable | HackerOne | None | 15 | – | – |
| HubSpot | HackerOne | Pays | 15 | – | 142,890 |
| Trip.com | HackerOne | Pays | 16 | – | – |
| Regions Financial | HackerOne | None | 16 | – | – |
| Freshworks | HackerOne | Pays | 16 | – | 143,400 |
| Anywhere Real Estate | HackerOne | None | 16 | – | 10,235 |
| USPS - United States Postal Service | HackerOne | None | 17 | – | – |
| Unico IDtech | HackerOne | Pays | 17 | – | – |
| The Walt Disney Company | HackerOne | None | 17 | – | 130,650 |
| Ro | HackerOne | None | 17 | – | 118 |
| Early Warning | HackerOne | Pays | 17 | – | – |
| Cloud Software Group | HackerOne | Pays | 17 | – | – |
| CLEAR | HackerOne | Pays | 17 | – | – |
| PagerDuty | HackerOne | None | 18 | – | 1,564 |
Programs and scope from each platform's public listing. Subdomains from ProjectDiscovery's Chaos dataset, still filling: 301 programs have them so far. Data as of 2026-11-15.