every public bounty program, one index.
1,460 programs across six platforms. Filter by scope, asset, payout. Highest live today: $15,000,000.
Used weekly by 2,000+ hunters. Free, no signup. Index refreshed 23h ago. MCP endpoint for agents.
- 1,460
- programs
- 868
- paying bounties
- 54,966
- in-scope assets
- 6
- platforms
Pulse
What's moving now.
Recently added
last 14 days
- 3d ago
Lively Apps GmbH - marketplace Bug Bounty Program
Bugcrowd · bounty
- 3d ago
Smart Guess ehf. - Marketplace Bug Bounty Program
Bugcrowd · bounty
- 3d ago
Amoeboids
Bugcrowd · bounty
- 3d ago
Algolia
HackerOne · bounty
- 3d ago
OneDoc
YesWeHack · bounty
- 3d ago
Excentia Bug Bounty
Bugcrowd · bounty
- 3d ago
Decadis AG
Bugcrowd · bounty
- 3d ago
Cvent Bug Bounty
Bugcrowd · bounty
What it does
Four things.
Done properly.
Index
Unified index
One table. Six platforms. Sort by max reward or opportunity score, filter by asset type, jump to the highest payouts first. 868 of 1,460 pay in cash right now.
/programsLookup
Scope lookup
Paste a domain. Instant verdict: in-scope somewhere, or not.
$ /scope/tesla.com
→ in scope · 2 programs
/scope/<domain>Score
Opportunity score
A single 0–100 number. Payout, bounty vs VDP, freshness. The formula is public.
/how-scoredFeed
Log & RSS
New programs surface within an hour, grouped as a dated log. Subscribe by RSS or read the web view.
/feedWhy this exists
Every alternative is fragmented.
Each platform shows its own programs. Directories are stale or policy-only. Raw JSON is fine if you enjoy jq. And none of them speak MCP. This is the one built for scanning, by you or your agent.
- Coverage
- 5 of 5 · unified
- Sort by payout
- ✓ max payout
- Scope lookup
- ✓ one query
- MCP / agent access
- ✓ /mcp endpoint
- Keyboard nav
- ✓ / j k ↵
- Coverage
- 1 of 5
- Sort by payout
- severity only
- Scope lookup
- ✗
- MCP / agent access
- ✗
- Keyboard nav
- ✗
- Coverage
- 1 of 5
- Sort by payout
- ✓ max payout
- Scope lookup
- ✗
- MCP / agent access
- ✗
- Keyboard nav
- ✗
- Coverage
- VDP policies only
- Sort by payout
- ✗
- Scope lookup
- ✗
- MCP / agent access
- ✗
- Keyboard nav
- ✗
- Coverage
- 5 of 5 · raw JSON
- Sort by payout
- grep + jq
- Scope lookup
- grep + jq
- MCP / agent access
- ✗
- Keyboard nav
- n/a
Receipts
Why trust this.
No funnel, no VC, no dark pattern. Everything load-bearing is public and verifiable.
Public upstream mirror of five platforms, plus a direct Immunefi scrape. One canonical source, no scraping of individual platforms.
The 0–100 opportunity score formula is published in full. Payout (55) + bounty (20) + freshness (25). No opaque tiers.
Daily snapshot cadence. Scope and reward changes diffed into history. See /whats-new and /reward-changes for the live log.
Sign-in is optional (GitHub, used only to sync watchlist across devices). Vercel Analytics is anonymous pageview counts, that's it.
Who runs this
Built and maintained by Varun. Solo, no team, no funding. If something’s broken, missing, or wrong, open an issue . I actually read them.
Start hunting
868 programs
are paying bounties
right now.
Filter the list, save an RSS, find the ones that fit your stack.
Curious how it’s built? how it works →
