What the programmes
are actually doing
City of Vienna Managed Bug Bounty led with 18 accepted findings, 12 programmes opened up, 10 went quiet.
The window moves active now, what just opened, where nobody is looking and what changed pace. The money, targets, severity and researcher reads are marked whole corpus and do not move with it: a week holds too few of each to read.
Where findings are landing
Programmes that accepted the most in the last 7 days, with the two things that separate a busy programme from a crowded one: how many different people are landing findings, and whether the platform showed money against any of them.
| Programme | Accepted | Finders | Crit/high | Paid | Last seen |
|---|---|---|---|---|---|
| City of Vienna Managed Bug Bounty | 18 | 10 +1 withheld | 4 | $10,750 | today |
| National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program | 15 | 13 +1 withheld | 4 | not set | yesterday |
| Nextcloud | 11 | 8 | not set | $550 | 2 days ago |
| Petpooja Vulnerability Disclosure Program | 10 | 2 | 2 | not set | 5 days ago |
| ClickHouse | 9 | 3 +3 withheld | 2 | not set | yesterday |
| Indeed | 8 | 1 +7 withheld | 1 | $200 | today |
| Keeper Security Public Bounty Program | 5 | 3 +1 withheld | not set | $500 | yesterday |
| United Airlines | 5 | 2 +3 withheld | 3 | not set | yesterday |
| curl | 4 | 3 | not set | not set | 3 days ago |
| Monero | 4 | 2 | 2 | not set | 5 days ago |
| Atlassian | 4 | 1 +3 withheld | 1 | not set | yesterday |
| Stiltsoft | 4 | 0 +4 withheld | not set | not set | 2 days ago |
What the work has paid whole corpus
Every figure here is built only from amounts a platform actually printed, and only in US dollars, the one currency with enough rows to sum honestly. Because a single week carries only a handful of published awards, this is the picture across everything on file, not the selected window.
A shown amount is rare. Bugcrowd seldom publishes a figure at all, and HackerOne shows one only on the minority of reports both sides later disclosed. So these 1,399 awards are the ones that happened to be printed, out of 6,285 events, and every total here is a floor. A programme with no amount against it may pay very well and simply never say so.
How large the shown awards were
- under $250 376 27%
- $250–999 575 41%
- $1k–5k 326 23%
- $5k–10k 60 4%
- $10k and up 62 4%
What a shown award was worth, by severity
Read as "when a finding at this severity was paid and the amount was published, here is the spread". It is not what a severity pays in general: the rows that carried no figure are not in it.
| Severity | Awards shown | Low | Typical | High | Total |
|---|---|---|---|---|---|
| Critical | 176 | $300 | $7,887 | $133,700 | $1,388,150 |
| High | 243 | $100 | $3,508 | $80,000 | $852,448 |
| Medium | 548 | $50 | $650 | $10,000 | $356,120 |
| Low | 418 | $20 | $194 | $1,000 | $80,959 |
| None | 8 | $25 | $163 | $500 | $1,300 |
| Unrated | 6 | $100 | $4,150 | $12,500 | $24,900 |
How the platforms differ in what they show
| Platform | Accepted | Amounts shown | Disclosed | Total shown |
|---|---|---|---|---|
| bugcrowd | 5,375 | 1,334 (25%) | 525 | $2,595,413 |
| hackerone | 910 | 65 (7%) | 910 | $108,464 |
The gap between "accepted" and "amounts shown" is mostly publication policy, not generosity. HackerOne rows are here only because a report was disclosed at all, so its "disclosed" count matches its accepted count by construction; Bugcrowd discloses a subset and prints an amount on fewer still.
Programmes seen to pay in the open
Programmes with at least one published award, most paid-out first. "Shown" is how many of their acceptances carried a visible figure, so a low ratio next to a high acceptance count means "shows money rarely", not "pays rarely".
| Programme | Accepted | Shown | Largest | Total shown |
|---|---|---|---|---|
| T-Mobile | 131 | 31 (24%) | $133,700 | $843,900 |
| Atlassian | 390 | 114 (29%) | $12,000 | $170,425 |
| OpenSea Managed Bug Bounty Program | 71 | 37 (52%) | $50,000 | $150,600 |
| City of Vienna Managed Bug Bounty | 136 | 79 (58%) | $3,500 | $101,700 |
| Fireblocks MPC Managed Bug Bounty Engagement | 13 | 3 (23%) | $80,000 | $90,300 |
| Tesla | 92 | 38 (41%) | $10,000 | $81,761 |
| Indeed | 165 | 70 (42%) | $10,000 | $67,750 |
| Centers for Medicare & Medicaid Services - Public Bug Bounty Program 2026 | 42 | 17 (40%) | $5,000 | $50,000 |
| Keeper Security Public Bounty Program | 107 | 19 (18%) | $11,000 | $45,400 |
| Cisco Networking | 67 | 23 (34%) | $8,025 | $37,475 |
The largest single awards on file
Open any of these for the full record: the asset it landed against, who found it, what state it is in, and whether a figure this size is normal for that programme.
-
T-Mobile $133,700 critical
-
T-Mobile $133,700 critical
-
Fireblocks MPC Managed Bug Bounty Engagement $80,000 high
-
T-Mobile $55,000 critical
-
T-Mobile $55,000 critical
-
OpenSea Managed Bug Bounty Program $50,000 critical
-
OpenSea Managed Bug Bounty Program $50,000 critical
-
T-Mobile $35,000 high
Which assets are producing findings whole corpus
The specific assets that accepted findings have landed against, and how serious those findings were. This is the highest-resolution signal on the site, and one nobody else publishes: an asset that keeps producing criticals is a very different prospect from one producing only lows.
In this data the named asset comes from Bugcrowd alone. HackerOne's disclosed reports do not carry the asset, so a HackerOne programme is simply absent from this table rather than under-hunted. We do not cross-reference these against the scope list: our scope data is HackerOne's and the targets here are Bugcrowd's, so the two never meet on one row, and a fuzzy match across that gap would invent a signal we cannot stand behind.
| Asset | Accepted | Finders | Crit | Crit/high | Last seen |
|---|---|---|---|---|---|
| https://nasa.gov | 385 | 236 +44 withheld | 65 | 87 | yesterday |
| https://github.com/ClickHouse/ClickHouse | 235 | 73 +72 withheld | 1 | 19 | yesterday |
| Public Others Target | 101 | 22 +56 withheld | 3 | 16 | 12 days ago |
| *.wien.gv.at | 77 | 29 +12 withheld | 21 | 31 | today |
| *.indeed.com | 69 | 26 +31 withheld | 2 | 4 | yesterday |
| *.comcast.com | 53 | 15 +31 withheld | 11 | 15 | 2 months ago |
| *.tesla.com | 51 | 20 +18 withheld | 5 | 11 | 7 days ago |
| Confluence Data Center | 47 | 14 +31 withheld | 1 | 14 | yesterday |
| https://bugcrowd-*your-own-instance*.cloud.mattermost.com/ | 46 | 19 +9 withheld | 0 | 2 | 11 days ago |
| *.meraki.com | 44 | 15 +19 withheld | 4 | 7 | 7 days ago |
| Petpooja Production Web Applications & APIs | 43 | 15 +6 withheld | 3 | 18 | 5 days ago |
| *.staging.gearset.com | 43 | 10 +31 withheld | 0 | 1 | 5 days ago |
Who accepts the serious findings whole corpus
Where the criticals and highs are actually landing. A programme that has never accepted anything above medium is telling you what it is worth your time for, and one that takes criticals is worth a harder look regardless of its volume.
| Programme | Critical | High | Accepted | Finders |
|---|---|---|---|---|
| National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program | 80 | 27 | 469 | 290 |
| T-Mobile | 40 | 43 | 131 | 36 |
| City of Vienna Managed Bug Bounty | 31 | 19 | 136 | 45 |
| Comcast Xfinity Vulnerability Disclosure Program | 25 | 9 | 71 | 8 |
| Comcast Xfinity Bug Bounty | 24 | 7 | 100 | 29 |
| Imperva - Thales Bug Bounty | 22 | 8 | 63 | 3 |
| Monash University Bug Bounty | 22 | 6 | 54 | 21 |
| curl | 17 | 44 | 351 | 226 |
| Atlassian | 16 | 76 | 390 | 101 |
| Keeper Security Public Bounty Program | 14 | 34 | 107 | 36 |
| Opera Public Bug Bounty | 14 | 18 | 91 | 42 |
| State of Maryland Vulnerability Disclosure Program | 14 | 4 | 30 | 16 |
Severity is the platform's own label, and roughly one event in fourteen carries no severity at all: those are counted nowhere here rather than assumed harmless.
Open ground, or a private garden whole corpus
A programme where a dozen different people are landing findings is ground a newcomer can plausibly break into. One where a single finder holds most of the accepted work may be effectively farmed, or may just have one prolific specialist. The numbers are here; the judgement is yours.
| Programme | Finders | Accepted | Most by one finder |
|---|---|---|---|
| National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program | 290 | 469 | 4% |
| curl | 226 | 351 | 20% |
| Atlassian | 101 | 390 | 13% |
| ClickHouse | 91 | 298 | 10% |
| Indeed | 66 | 165 | 6% |
| City of Vienna Managed Bug Bounty | 45 | 136 | 21% |
| Opera Public Bug Bounty | 42 | 91 | 15% |
| Node.js | 42 | 48 | 6% |
| Nextcloud | 41 | 63 | 11% |
| Tesla | 40 | 92 | 12% |
| Mattermost Public Bug Bounty Engagement | 39 | 109 | 24% |
| T-Mobile | 36 | 131 | 10% |
The share is the busiest single named finder as a fraction of the named events only. A withheld name is unknown, not one more entry for the same person, so it never inflates or deflates the figure; where withholding is heavy the row notes it and the share is a floor.
What just opened
Programmes the directory sync caught launching, switching bounties on, or reopening submissions. A programme in its first weeks has the shallowest queue it will ever have.
-
Brave Software Reopened submissions
Nothing accepted on it in our sample yet. Pays.
-
Coveo Reopened submissions
Nothing accepted on it in our sample yet. Pays up to $5,500.
-
TrueLayer Reopened submissions
Nothing accepted on it in our sample yet. Pays up to $6,000.
-
Kahoot Reopened submissions
Nothing accepted on it in our sample yet. Pays up to $5,000.
-
Unisys Managed Bug Bounty Engagement Launched
Nothing accepted on it in our sample yet. Pays up to $4,500.
-
Vercel Launched
Nothing accepted on it in our sample yet. Pays.
-
PowerDNS Launched
Nothing accepted on it in our sample yet. Pays up to $8,000.
-
Kinepolis Group Reopened submissions
Nothing accepted on it in our sample yet. Pays up to $5,000.
-
DataCamp Reopened submissions
Nothing accepted on it in our sample yet. Pays up to $1,500.
-
Challenge 0926 Launched
Nothing accepted on it in our sample yet.
-
Kinepolis Group Reopened submissions
Nothing accepted on it in our sample yet. Pays up to $5,000.
-
Delen Private Bank Reopened submissions
Nothing accepted on it in our sample yet. Pays up to $15,000.
Where nobody is looking
Two different kinds of quiet, kept apart because the evidence behind them is not the same strength. The first list is programmes whose output fell: they used to produce findings and have slowed. The second is live, bounty-paying programmes where we have seen nothing at all.
Quiet is an opportunity signal, not a promise, and it has at least three causes we cannot tell apart from here: the programme may be genuinely under-hunted; it may be hard, or narrow enough in scope that there is little to find; or it may be picked clean, in which case everyone before you already took the easy ground. A silent programme can also just mean the platform stopped publishing its activity, and a HackerOne row here is measuring how often that programme discloses, which is a policy decision more than a hunting one. Use this as a shortlist to go and look at, and read the scope before you read anything into the number.
Output fell away
-
Comcast Xfinity Bug Bounty Pays
100 events on record from 29 named finders over 135 days, about 10.4 in a normal 14 days for it. It had none. Last one 2 months ago.
-
State of Maryland Vulnerability Disclosure Program
30 events on record from 16 named finders over 40 days, about 10.5 in a normal 14 days for it. It had 1. Last one 8 days ago.
-
Mastercard Public Bug Bounty Pays
120 events on record from 29 named finders over 175 days, about 9.6 in a normal 14 days for it. It had 1. Last one 12 days ago.
-
Comcast Xfinity Vulnerability Disclosure Program
71 events on record from 8 named finders over 159 days, about 6.3 in a normal 14 days for it. It had none. Last one 29 days ago.
-
eToro Managed Bug Bounty Engagement Pays
72 events on record from 35 named finders over 173 days, about 5.8 in a normal 14 days for it. It had none. Last one 15 days ago.
-
Imperva - Thales Bug Bounty Pays
63 events on record from 3 named finders over 160 days, about 5.5 in a normal 14 days for it. It had none. Last one 29 days ago.
-
Mattermost Public Bug Bounty Engagement Pays
109 events on record from 39 named finders over 190 days, about 8 in a normal 14 days for it. It had 3. Last one 5 days ago.
-
Centers for Medicare & Medicaid Services - Public Bug Bounty Program 2026 Pays
42 events on record from 11 named finders over 119 days, about 4.9 in a normal 14 days for it. It had none. Last one 29 days ago.
-
CoStar Vulnerability Disclosure Engagement
9 events on record from 3 named finders over 28 days, about 4.5 in a normal 14 days for it. It had none. Last one 14 days ago.
-
Arlo Cash Rewards Pays
52 events on record from 22 named finders over 164 days, about 4.4 in a normal 14 days for it. It had none. Last one 17 days ago.
Live, paying, nothing seen
Open, bounty-paying, and nothing in our sample for 14 days. That can mean the platform does not publish this programme's activity at all. Check before you read it as an opening.
-
Swiss Post - E-Voting
Nothing on record at all. Pays up to $230,000.
-
Fireblocks MPC Managed Bug Bounty Engagement
13 events on record, none recently. Pays up to $150,000.
-
Intel®
Nothing on record at all. Pays up to $100,000.
-
SpaceX/Starlink
5 events on record, none recently. Pays up to $100,000.
-
Capture Our Flag
Nothing on record at all. Pays up to $51,337.
-
Doctolib
Nothing on record at all. Pays up to $50,000.
-
Kiteworks
Nothing on record at all. Pays up to $50,000.
-
Zendesk Managed Bug Bounty Engagement
Nothing on record at all. Pays up to $50,000.
-
AXIS OS
32 events on record, none recently. Pays up to $40,000.
-
Altera
Nothing on record at all. Pays up to $30,000.
What changed pace
The last 7 days against the 7 before them, for programmes with enough events for a change to mean anything.
Rising
-
Nextcloud
+11 · 0 to 11 (no prior activity on record)
-
Keeper Security Public Bounty Program
+4 · 1 to 5 (400%)
-
Monero
+4 · 0 to 4 (no prior activity on record)
-
Stiltsoft
+3 · 1 to 4 (300%)
-
EPAM Systems Managed Bug Bounty Program
+1 · 2 to 3 (50%)
-
Gearset: Managed Bug Bounty
+1 · 2 to 3 (50%)
Falling
-
ClickHouse
-20 · 29 to 9 (-69%)
-
National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
-14 · 29 to 15 (-48%)
-
OpenSea Managed Bug Bounty Program
-13 · 13 to 0 (-100%)
-
New Balance VDP
-12 · 12 to 0 (-100%)
-
AB InBev Vulnerability Disclosure Program
-11 · 13 to 2 (-85%)
-
Bitdefender
-10 · 11 to 1 (-91%)
How this is built. Two scheduled jobs read the platforms' own public feeds (Bugcrowd's CrowdStream and HackerOne's disclosed reports) a few pages at a time, and store one row per published event. There are no report titles here and no vulnerability details: those feeds do not carry them and we do not go looking. Where a platform withheld the finder's name we store it as withheld and leave it that way. Counts are a floor on activity, never a measurement of it: a programme can be busy and publish nothing, and money is only ever printed where a platform printed it first. Last ingest today.