Bug bounty programs942
Public programs on HackerOne, Bugcrowd, Intigriti and YesWeHack: scope, disclosed reports and subdomains.
| Program | Platform | Bounty | Assets | Reports | Subdomains |
|---|---|---|---|---|---|
| Figma | HackerOne | Pays | 8 | 1 | – |
| Newegg | HackerOne | Pays | 8 | 1 | 19,743 |
| Gymshark | HackerOne | None | 7 | 1 | 571 |
| On | HackerOne | None | 5 | 1 | – |
| BlackRock | HackerOne | None | 4 | 1 | – |
| Planet Labs | HackerOne | None | 4 | 1 | – |
| SMTP2GO BBP | HackerOne | Pays | 3 | 1 | 8,693 |
| ProductBoard, Inc. | HackerOne | None | 2 | 1 | – |
| Sheer | HackerOne | Pays | 2 | 1 | – |
| CERT/CC | HackerOne | None | – | 1 | – |
| Fiserv | HackerOne | None | 10,922 | – | – |
| CBRE | HackerOne | None | 8,688 | – | 5,955 |
| Clarivate | HackerOne | None | 5,026 | – | – |
| John Deere | HackerOne | None | 2,060 | – | 6,193 |
| ION Group | HackerOne | None | 1,444 | – | – |
| DIB-VDP | HackerOne | None | 1,094 | – | 808 |
| ABB Information Systems Ltd | HackerOne | None | 1,063 | – | – |
| NBA Public Bug Bounty | HackerOne | Pays | 460 | – | – |
| Ferrero | HackerOne | None | 416 | – | – |
| Mondelēz International | HackerOne | None | 371 | – | – |
| Aegean Airlines Vulnerability Disclosure | HackerOne | None | 292 | – | – |
| Henkel | HackerOne | None | 279 | – | – |
| Aon | HackerOne | None | 257 | – | – |
| PepsiCo VDP | HackerOne | None | 227 | – | – |
| HPE VDP | HackerOne | None | 207 | – | – |
| Alshaya | HackerOne | None | 184 | – | – |
| Optus Managed Bug Bounty | Bugcrowd | Pays | 168 | – | – |
| Visa | HackerOne | Pays | 168 | – | – |
| TransUnion LLC | HackerOne | None | 154 | – | – |
| Itaú Unibanco | HackerOne | None | 137 | – | – |
| Allegion | HackerOne | None | 130 | – | 9,274 |
| Watsons | Intigriti | Pays | 123 | – | – |
| Amazon Vulnerability Research Program | HackerOne | Pays | 120 | – | 90,561 |
| Atlassian-Built Apps | Bugcrowd | Pays | 119 | – | 59 |
| Epic Games VDP | HackerOne | None | 91 | – | 34,453 |
| Mateco VDP | Intigriti | None | 89 | – | – |
| Opera Public Bug Bounty | Bugcrowd | Pays | 89 | – | 4,997 |
| Epic Games | HackerOne | Pays | 86 | – | 285,492 |
| Twilio | HackerOne | Pays | 83 | – | 4,135 |
| Citymesh Responsible Vulnerability Disclosure Program | Intigriti | None | 82 | – | – |
| Marionnaud | Intigriti | Pays | 77 | – | – |
| T-Mobile | Bugcrowd | Pays | 76 | – | – |
| Fifth Third Bank VDP | HackerOne | None | 73 | – | – |
| LATAM Airlines | HackerOne | None | 71 | – | – |
| HARMAN International - Web Applications | YesWeHack | Pays | 67 | – | 526 |
| Vodafone | HackerOne | None | 67 | – | – |
| Dyson | HackerOne | Pays | 66 | – | – |
| Playtika | HackerOne | Pays | 65 | – | – |
| ResMed | HackerOne | None | 63 | – | 1,479 |
| KKR-VDP | HackerOne | None | 60 | – | – |
Programs and scope from each platform's public listing. Subdomains from ProjectDiscovery's Chaos dataset, still filling: 299 programs have them so far. Data as of 2026-11-14.