Bug bounty programs942
Public programs on HackerOne, Bugcrowd, Intigriti and YesWeHack: scope, disclosed reports and subdomains.
| Program | Platform | Bounty | Assets | Reports | Subdomains |
|---|---|---|---|---|---|
| U.S. Dept Of Defense | HackerOne | None | – | 884 | – |
| curl | HackerOne | None | 1 | 682 | – |
| Nextcloud | HackerOne | Pays | 94 | 613 | 1,642 |
| HackerOne | HackerOne | Pays | 26 | 607 | 127 |
| Shopify | HackerOne | Pays | 24 | 467 | 27,669 |
| GitLab | HackerOne | Pays | 19 | 257 | 785 |
| X / xAI | HackerOne | Pays | 23 | 248 | 10,596 |
| Uber | HackerOne | Pays | 4 | 239 | 11,395 |
| Automattic | HackerOne | Pays | 30 | 166 | 277 |
| Weblate | HackerOne | None | 6 | 157 | 36 |
| Node.js | HackerOne | Pays | 1 | 154 | – |
| Slack | HackerOne | Pays | 19 | 133 | 137,429 |
| MTN Group | HackerOne | None | 498 | 128 | 214,283 |
| Eternal | HackerOne | Pays | 34 | 128 | 60 |
| Acronis | HackerOne | Pays | 21 | 128 | 2,284 |
| Starbucks | HackerOne | Pays | 10 | 128 | 5,439 |
| TikTok | HackerOne | Pays | 35 | 117 | 821 |
| Rockstar Games | HackerOne | Pays | 9 | 106 | 496 |
| Ubiquiti Inc. | HackerOne | Pays | 53 | 98 | 65,487 |
| WordPress | HackerOne | Pays | 23 | 96 | – |
| 8x8 | HackerOne | Pays | 117 | 91 | 9,482 |
| Concrete CMS | HackerOne | None | 1 | 87 | – |
| Valve | HackerOne | Pays | 21 | 82 | 790 |
| Monero | HackerOne | None | – | 82 | – |
| Coinbase | HackerOne | Pays | 16 | 80 | 1,045 |
| Kubernetes | HackerOne | Pays | 82 | 77 | 662 |
| Yelp | HackerOne | Pays | 8 | 74 | – |
| Ruby | HackerOne | Pays | 1 | 73 | – |
| Ruby on Rails | HackerOne | None | 1 | 73 | – |
| Phabricator | HackerOne | Pays | – | 73 | – |
| HackerOne | Pays | 27 | 72 | 23,159 | |
| Stripo Inc | HackerOne | None | 2 | 72 | 108 |
| Vimeo | HackerOne | Pays | 30 | 71 | 10,008 |
| Khan Academy | HackerOne | None | – | 71 | 382 |
| Mars | HackerOne | None | 113 | 68 | 3,528 |
| Informatica | HackerOne | None | 5 | 68 | 1,177 |
| WakaTime | HackerOne | None | 1 | 63 | – |
| AWS VDP | HackerOne | None | 555 | 61 | 3,036 |
| MariaDB | HackerOne | None | 5 | 61 | 67 |
| Revive Adserver | HackerOne | None | 1 | 61 | – |
| Basecamp | HackerOne | Pays | 17 | 57 | – |
| Semrush | HackerOne | Pays | 14 | 56 | 5,693 |
| Tor | HackerOne | Pays | 1 | 53 | – |
| Chaturbate | HackerOne | Pays | 9 | 52 | 23,056 |
| IBM | HackerOne | None | 3 | 48 | 104,391 |
| GitHub | HackerOne | Pays | 27 | 47 | 56,442 |
| Cloudflare Public Bug Bounty | HackerOne | Pays | 51 | 44 | 24,296 |
| HackerOne | Pays | 5 | 44 | – | |
| PortSwigger Web Security | HackerOne | Pays | 10 | 40 | 928 |
| Lark Technologies | HackerOne | Pays | 17 | 38 | 1,634 |
Programs and scope from each platform's public listing. Subdomains from ProjectDiscovery's Chaos dataset, still filling: 299 programs have them so far. Data as of 2026-11-14.