How crowded is each
program?
Nobody wants to spend a weekend on a program where they are report number 125 and every finding is a duplicate. Platforms have no reason to say which programs are that crowded. This page shows which ones are, and which ones are not.
Crowding counts how many people are working a program. Recognition is the share of their submitted work the program accepted. A program can be uncrowded and still accept almost nothing.
Both are snapshots. A program that has been live for six years with 8,000 reports is in a steady state. One that has been live for eighteen hours with 200 is not. Neither is one that had 8,000 and took in another 7,000 this week, and that is the one to know about before you start. The last two sections show movement, meaning how fast a program is taking in reports now compared with its own normal rate.
The most crowded programs
These programs took the most reports per in-scope asset over the last 90 days. Only programs with at least 20 reports in that window are included, so no ratio rests on a handful of reports. Reports per participant shows whether the load comes from many hunters or from a few people filing a lot. A crowded program is usually a popular one. A high figure here is not a criticism.
This measure has two limits. First, it is an average across the scope. A low figure does not mean every asset is quiet, and a high one does not mean every asset is busy, because most reports may go to a few targets. Second, a high report count says nothing about the quality of those reports. We have no data on quality and make no claim about it.
| Program | Reports 90d | Assets | Reports / asset | Reports / participant | Recognised | Last resolved | Age |
|---|---|---|---|---|---|---|---|
| Omarchy new | 1,849 | 1 | 1,849.0 | 168.1 | under 200 submitted | unknown | 1 mo |
| Vercel Sandbox new | 1,277 | 1 | 1,277.0 | 21.3 | under 200 submitted | unknown | 2 mo |
| TRON DAO | 1,025 | 1 | 1,025.0 | 51.3 | under 200 submitted | 59 d ago | 3 yr |
| U.S. Dept Of Defense | 1,372 | 2 | 686.0 | 0.44 | 68.1% | yesterday | 9 yr |
| Bumba | 293 | 1 | 293.0 | 19.5 | under 200 submitted | 116 d ago | 1 yr |
| IBM | 1,134 | 4 | 283.5 | 0.51 | 61.5% | today | 8 yr |
| Anthropic new | 5,336 | 23 | 232.0 | 9.15 | 22.4% | yesterday | 6 mo |
| Verisk VDP new | 402 | 2 | 201.0 | not set | none published | unknown | 29 d |
| Discourse | 371 | 2 | 185.5 | 1.32 | 55.3% | 72 d ago | 9 yr |
| Node.js | 182 | 1 | 182.0 | 0.89 | 52.3% | 2 d ago | 8 yr |
Last resolved is the time since the program last resolved any report, from its own figures. It shows whether the queue is moving. We do not divide the lifetime resolved total by the 90-day intake to get a drain rate. One is a running total and the other is a 90-day window, so the result would be misleading. Age counts from the program's launch date. Heavy load on a program that is many years old is its normal level. The same load a few days after launch would be a rush. Recognised is the share of submitted work the program accepted from the hunters it credits. Read it next to the load. A crowded program that recognises 40% is a different prospect from a crowded one that recognises 5%. It counts credited hunters only, so it overstates the real rate. The recognition section below explains why.
The least crowded paying programs
These programs are open to submissions, offer bounties, have a payout on record, and have a low report load per asset. It is the same measure as above, sorted from the other end, with the lowest load first. Use it as a shortlist to look into.
| Program | Reports / asset | Reports 90d | Assets | Paid to date | Recognised | Access |
|---|---|---|---|---|---|---|
| ForeScout Technologies | 0.29 | 45 | 157 | $117,600 | 51.1% | open to all |
| Visa | 0.67 | 146 | 218 | $91,150 | 40.1% | open to all |
| Marriott Bug Bounty Program | 0.82 | 247 | 301 | $638,998 | 49.0% | open to all |
| Cloud Software Group | 0.94 | 50 | 53 | $543,499 | 61.5% | open to all |
| GoodRx | 1.08 | 28 | 26 | $70,000 | 63.7% | open to all |
| Scopely | 1.29 | 84 | 65 | $390,000 | 51.3% | open to all |
| EXNESS | 1.30 | 103 | 79 | $603,206 | 54.9% | open to all |
| Dyson | 1.33 | 293 | 220 | $486,660 | 51.2% | open to all |
| Credit Karma | 1.38 | 44 | 32 | $111,550 | 57.7% | open to all |
| FetLife | 1.43 | 20 | 14 | $65,352 | 48.7% | open to all |
Paid to date is the program's lifetime paid total as HackerOne shows it. It shows the program has paid. It says nothing about what your report will get. If a program is known to pay but hides the figure, the cell reads "pays, amount not shown". A low load per asset is worth looking into, but it does not mean the findings will be easy. A program can be quiet because few people hunt it, because it is hard, or because the easy findings are already gone. This measure cannot tell those apart. Read the scope before you read anything into the number. Also check Recognised. A quiet program is worth little if it accepts almost nothing.
How much submitted work gets recognised
For each researcher a program publicly credits, HackerOne shows how many reports that person submitted and how many were recognised. Adding these up across a program's credited hunters gives a recognition rate. It is the number a hunter most wants to see before spending a weekend on a program. The lowest rates come first. Only programs whose credited hunters have submitted at least 200 reports are included, so no rate is based on a handful.
Read this before the numbers. A thanks list includes more people than the name suggests. A researcher is added once one of their reports reaches triage, which happens long before anyone decides whether the report was worth anything. So the list, which is the denominator here, includes plenty of people who ended up with nothing. In the lists we hold, 19.1% of entries have zero recognised reports, some after dozens of submissions.
The list still misses anyone whose reports were closed before a human triaged them, as duplicates, out of scope or spam. Those people leave no record. So these figures run slightly high, but not by much. Treat them as close to an upper limit. They do not cover everyone who has ever submitted to the program.
A low rate is not evidence that a program is unfair. It also says nothing about the quality of what was sent to it. Duplicates, out-of-scope reports and informatives all fall in the gap between submitted and recognised, and this data cannot tell them apart. The numbers show what happened. They do not explain why.
| Program | Recognition rate | Recognised | Submitted | Credited hunters |
|---|---|---|---|---|
| Chia Network | 4.9% | 82 | 1,665 | 116 |
| HackerOne | 15.9% | 1,700 | 10,716 | 978 |
| Alibaba BBP | 21.2% | 356 | 1,681 | 537 |
| Circle | 22.0% | 454 | 2,060 | 389 |
| Crypto.com | 22.3% | 523 | 2,341 | 669 |
| Anthropic | 22.4% | 1,001 | 4,462 | 597 |
| Lightspark BBP | 22.9% | 96 | 420 | 102 |
| Stripchat | 24.2% | 69 | 285 | 68 |
| Cosmos | 24.7% | 256 | 1,037 | 371 |
| Shopify | 25.4% | 3,144 | 12,386 | 1,241 |
The rate is total recognised divided by total submitted. We do not average each hunter's own percentage. Pooling the counts weights each person by how much they submitted. Averaging would let one recognised report out of one count as much as 62 out of 142. Both counts are HackerOne's published figures, taken from the program's public thanks page.
Programs taking in
reports faster than usual
Everything above is a level, meaning how busy a program is right now. A level cannot show whether a program has been this busy for years or changed sharply in the last week, and that difference matters when you choose where to spend a weekend. This table shows the rate of change against a program's own baseline over the last 7 days.
A program that has been live for six years with 8,000 reports sits at 1.00× here, because 8,000 is its normal. If the same program takes in another 7,000 in a week, its figure rises. That is why raw volume plays no part in this ranking.
What the intake column means. HackerOne publishes reports received in the last 90 days as a rolling window. So the difference between two readings is new arrivals minus reports that dropped out of the window. It is not the number of reports received since our last reading, and we never add these differences up and call them new reports. It measures how much faster a program is taking in reports now than it was 90 days ago. A steady program sits at zero, however large it is. Resolution and new hunters come from lifetime counters that only go up, so those two are true rates.
A rise in reports does not mean anything is wrong with a program. It may have launched something, shipped a release, been written about, widened its scope or raised its rewards. This table shows how much the traffic changed. It does not show why, and it says nothing about the quality of what was sent. Use a high figure to plan your time. It is not a criticism of the program.
| Program | Vs own baseline | Intake change / hr | Reports 90d | Resolved / hr | New hunters / hr | Age | Read from |
|---|---|---|---|---|---|---|---|
| lemlist hourly | 7.75× | +0.10 | 32 | 0.05 | 0.01 | 2,571 d | 36 reads, 6 d |
| Solidus hourly | 5.87× | +0.17 | 77 | 0.08 | 0.04 | 2,704 d | 76 reads, 6 d |
| Hertz VDP hourly | 3.74× | +0.07 | 52 | 0.00 | 0.00 | 568 d | 168 reads, 7 d |
| 1win hourly | 3.38× | +0.42 | 383 | 0.00 | 0.04 | 220 d | 58 reads, 6 d |
| Weblate hourly | 3.25× | +0.23 | 218 | 0.23 | 0.02 | 3,484 d | 164 reads, 7 d |
| Insightly | 2.79× | +0.30 | 363 | 0.00 | 0.04 | 849 d | 7 reads, 6 d |
| PepsiCo VDP | 2.72× | +0.07 | 88 | 0.03 | 0.02 | 767 d | 7 reads, 6 d |
| Stripe | 2.71× | +0.99 | 1,256 | 0.24 | 0.06 | 1,950 d | 7 reads, 6 d |
| IBM hourly | 2.65× | +0.87 | 1,134 | 0.21 | 0.17 | 2,978 d | 168 reads, 7 d |
| Kubernetes | 2.57× | +0.71 | 983 | 0.00 | 0.28 | 2,489 d | 7 reads, 6 d |
Vs own baseline estimates what the program is taking in now as a multiple of its own 90-day average. The estimate runs low. The baseline comes from the latest figure, which already includes part of any rise, so a program well into a surge is understated. Read from shows how many readings each row is based on, and over what span. A program read every hour gives a sharper figure than one read once a day, and a row based on three reads is weaker than one based on twenty. With fewer than 3 reads, or a span under 6 hours, we show no figure, because two points are not enough for a trend. A program also needs at least 20 reports in the window and 10 of net movement, so a count that drifts by three is never ranked as a surge.
Programs with no baseline yet
A program that opened this week has no history to compare against, so the table above cannot rank it. This table uses reports per hour since it opened, which needs no history. It covers programs launched in the last 90 days, fastest first.
Why this figure is exact and the one above is an estimate. A program younger than 90 days has had nothing drop out of HackerOne's rolling 90-day window yet. So the count is every report it has ever received, and dividing by its age gives a true reports-per-hour rate. After 90 days that no longer holds, so the program drops off this table.
Read this next to the assets column. A hundred reports over eighty in-scope assets is a busy launch. A hundred reports against a single asset is far more crowded. As with the rest of this page, none of this says anything about what those reports contained. Report quality is not published anywhere, and we do not guess at it.
| Program | Reports / hour | Reports since launch | Open for | Assets | Reports / asset | Hunters | Access |
|---|---|---|---|---|---|---|---|
| Vercel new | 3.72 | 4,165 | 47 d | 29 | 143.6 | 312 | open to all |
| Arc new | 3.50 | 4,394 | 52 d | 44 | 99.9 | 11 | open to all |
| Omarchy new | 2.10 | 1,849 | 37 d | 1 | 1,849.0 | 11 | open to all |
| Live Nation new | 1.16 | 1,212 | 44 d | 37 | 32.8 | 195 | ID verified |
| d-you App & German EUDI Wallet Ecosystem new | 0.90 | 1,120 | 52 d | 19 | 58.9 | 6 | ID verified |
| XP Inc Vulnerability Disclosure new | 0.74 | 189 | 11 d | 15 | 12.6 | 12 | open to all |
| Vercel Sandbox new | 0.66 | 1,277 | 81 d | 1 | 1,277.0 | 60 | submissions closed |
| Verisk VDP new | 0.56 | 402 | 30 d | 2 | 201.0 | 0 | open to all |
| Smartsheet (VDP) new | 0.48 | 99 | 9 d | 14 | 7.07 | 5 | open to all |
| Nebius AI Vulnerability Disclosure new | 0.28 | 302 | 45 d | 21 | 14.4 | 0 | open to all |
Open for counts from the launch date HackerOne publishes. That is when the program went public, which may be later than when it started taking reports. A program that ran privately first will look busier in its first public hours than it was. Treat a very young row as an early reading.
This page is built from public data. A scheduled job reads each HackerOne program's public page and stores a snapshot of reports received in the last 90 days, the resolved total, participants, published payout figures, and any limits on who can submit. Most programs are read once a day. A small set is picked automatically and read every hour: programs that opened in the last month, programs already moving, and programs someone has reviewed here. Reading all six thousand every hour would come to seventeen gigabytes a year and nearly two requests a second against someone else's service, which would be unreasonable. So the hourly reads go to the programs where a change is most likely to matter. This page joins the latest snapshot to the in-scope asset count and divides. The last two sections compare a program's recent readings with its earlier ones. A second job reads each program's public thanks page, which supplies the recognised and submitted counts behind the recognition rate. That data covers fewer programs, and it names only researchers a program chose to credit. This page has no report titles, no vulnerability details and nothing about report quality. None of that is published, and we do not guess at it. We are still backfilling, so the number of ranked programs will grow. The brief covers what programs are doing week to week. Figures captured today.