Overview
The largest public bug bounty and VDP marketplace. Hosts many top brands, live hacking events, and a deep disclosed-report library via Hacktivity. Best starting point for volume and reputation building.
How to make the most of it
- · Start with clearer VDPs and beginner-friendly public programs before chasing ultra-competitive targets.
- · Build Signal and Impact through clear, well-scoped reports—not volume of invalids.
- · Read program policies carefully; use Hacktivity and disclosed reports to learn report quality.
- · Track private invites; consistency and reputation unlock better programs.
- · Use structured recon and tight reproduction steps to survive slower triage queues.
Basic rules
- Only test assets listed in scope; respect out-of-scope rules.
- No DoS, social engineering, or physical attacks unless explicitly allowed.
- Do not access other users' data beyond proof of impact.
- Follow disclosure timelines and safe harbor language in the policy.
- Submit one clear report per issue; avoid duplicate spam.
Always read the live program policy — platform norms never override scope.
Best for
All levels — widest program selection and public reputation
Payout notes
Typically $500–$50,000+ on top programs; timelines vary by triage
Learn on YouTube
Search results for explainers and walkthroughs. Verify freshness and prefer official channels when available.