BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.
Programs / Malwarebytes

In brief. Malwarebytes is a bug bounty program on HackerOne. Its critical reports have paid an average of $3,400 across 20 reports (HackerOne figures, November 7, 2026). It received 342 reports in the 90 days to November 7, 2026, about 4.1 per in-scope asset. As of Nov 7, 2026. Markdown for agents

NR Unrated

Malwarebytes

Malwarebytes HackerOne
3 more reviews needed for a grade
Write a review
Program page hackerone.com ↗
Claim this company profile

Work at Malwarebytes? Claim it to respond to reviews as the verified owner.

Found a vulnerability?

If you'd rather not deal with the vendor yourself, a BugRater analyst will submit it to them for you, with your explicit permission, and tell you what they said.

Ask BugRater to submit it

Reports are private. The report body is encrypted at rest. BugRater holds the key, so the analyst handling your report can read it, and we log every time someone does.

Program metrics HackerOne, published

These are HackerOne’s own figures for this program, taken from its public page. Researchers did not report them, and they don't count toward the BugRater grade. Captured 7 Nov 2026.

What it pays, by severity

Critical $3,400 avg 20 reports indicative
High $1,308 avg 107 reports firm
Medium $378 avg 170 reports firm
Low $98 avg 78 reports firm

$280,000 paid to researchers in total, $30,000 of it in the last 90 days. This is HackerOne’s lifetime figure. It shows the program has paid out before. It doesn't tell you what any one report will get.

Intake & responsiveness, last 90 days

Reports received
342
in 90 days
Resolved
385
all time, last one yesterday
Participants
401
hunters engaged
Response efficiency
72%
below its own targets, HackerOne’s figure
SLA misses
0
targets missed
Reports received, day by day, last 30 days 342–418
8 Oct 342 reports 7 Nov

Response targets it sets itself

First response
2 days
Triage
10 days
Bounty
90 days
Resolution
30 days

These are targets the program set. They don't show whether it meets them.

Barriers to submitting

bounty amounts hidden submissions paused

Over 78 days (57 snapshots): intake up 91 reports; response efficiency down 2 points; 90-day payout down $10,000.

See how this program’s report load compares to others

Reviews

0 published

No reviews yet.

Be the first to review

Who this program credits

411 credited

Researchers HackerOne shows on this program’s public thanks list, best position first. “Recognised” is how many of a hunter’s submissions the program accepted; the ratio is their signal here, not our judgement of them.

# Researcher Reputation Recognised / submitted
1 bigbug 775 21 / 30 70%
2 vultza 665 16 / 18 89%
3 zy9ard3 454 13 / 15 87%
3 bc899613b0c246dccade1a4 111 0 / 1 0%
4 amunius 442 9 / 11 82%
5 deivizzzz 437 8 / 14 57%
6 xzemit42 385 13 / 31 42%
7 todayisnew 364 19 / 26 73%
7 larocas 351 5 / 10 50%
8 xcoder074 298 4 / 7 57%
9 mmg 270 9 / 22 41%
10 godiego 244 9 / 10 90%
11 valent1ad 223 7 / 9 78%
12 assafka 203 4 / 4 100%
13 m0chan 201 9 / 14 64%
14 ch1naa 200 6 / 6 100%
15 rivest 191 0 / 5 0%
16 xavlimsg 190 2 / 6 33%
17 proabiral 180 12 / 12 100%
18 d0xing 178 10 / 10 100%
19 gee-netics 174 4 / 8 50%
20 n13s 167 9 / 14 64%
21 filip_000 150 2 / 4 50%
22 europa 145 5 / 6 83%
23 r9r9r9 133 6 / 11 55%

Showing the top 25 of 411 credited on HackerOne.

Program profile HackerOne, imported

HackerOne published these facts on the program's page. Researchers did not report them, and they don't count toward the BugRater grade. Last checked 4 Nov 2026.

Cyberprotection for every one.

Responsiveness
71% HackerOne’s figure
Swag
No
Currency
USD
Submissions
Paused
Launched
Feb 2023
Scope entries
97 HackerOne’s count

Scope

91 assets
AssetTypeEligibilityMax severity
*.cloud.malwarebytes.com WILDCARD ✓ bounty Critical
*.cyrus-security.com WILDCARD ✓ bounty Critical
*.malwarebytes.com WILDCARD ✓ bounty Critical
*.mb-cosmos.com WILDCARD ✓ bounty Critical
*.mbamupdates.com WILDCARD ✓ bounty Critical
Show all 91 assets
AssetTypeEligibilityMax severity
*.mwb-threatintel.com WILDCARD ✓ bounty Critical
*.mwbsys.com WILDCARD ✓ bounty Critical
*.threatdown.com WILDCARD ✓ bounty Critical
AdwCleaner DOWNLOADABLE EXECUTABLES ✓ bounty Critical
Any other Malwarebytes asset OTHER ✓ bounty Critical
Any other ThreatDown asset OTHER ✓ bounty Critical
app-support.malwarebytes.com URL ✓ bounty Critical
ark.malwarebytes.com URL ✓ bounty Critical
assessment.malwarebytes.com URL ✓ bounty Critical
block.malwarebytes.com URL ✓ bounty Critical
blog.malwarebytes.com URL ✓ bounty Critical
br.malwarebytes.com URL ✓ bounty Critical
BrowserGuard (Firefox/Chrome/Safari browser extension) OTHER ✓ bounty Critical
buy.malwarebytes.com URL ✓ bounty Critical
cdn.blog.malwarebytes.com URL ✓ bounty Critical
click.malwarebytes.com URL ✓ bounty Critical
cloud.malwarebytes.com URL ✓ bounty Critical
cloud.threatdown.com URL ✓ bounty Critical
com.malwarebytes.Malwarebytes APPLE STORE APP ID ✓ bounty Critical
contrib-adwcleaner.malwarebytes.com URL ✓ bounty Critical
de.malwarebytes.com URL ✓ bounty Critical
devshop.malwarebytes.com URL ✓ bounty Critical
downloads.malwarebytes.com URL ✓ bounty Critical
edr.malwarebytes.com URL ✓ bounty Critical
es.malwarebytes.com URL ✓ bounty Critical
fr.malwarebytes.com URL ✓ bounty Critical
fullsandshop.malwarebytes.com URL ✓ bounty Critical
go.malwarebytes.com URL ✓ bounty Critical
go2.malwarebytes.com URL ✓ bounty Critical
https://oneview.threatdownstage.com URL ✓ bounty Critical
image.malwarebytes.com URL ✓ bounty Critical
info.malwarebytes.com URL ✓ bounty Critical
iptest.malwarebytes.com URL ✓ bounty Critical
it.malwarebytes.com URL ✓ bounty Critical
jobs.malwarebytes.com URL ✓ bounty Critical
links.malwarebytes.com URL ✓ bounty Critical
Malwarebytes 4 DOWNLOADABLE EXECUTABLES ✓ bounty Critical
Malwarebytes Endpoint Protection & Incident Response DOWNLOADABLE EXECUTABLES ✓ bounty Critical
Malwarebytes for Mac DOWNLOADABLE EXECUTABLES ✓ bounty Critical
Malwarebytes for Teams DOWNLOADABLE EXECUTABLES ✓ bounty Critical
Malwarebytes for Windows DOWNLOADABLE EXECUTABLES ✓ bounty Critical
Malwarebytes Incident Response DOWNLOADABLE EXECUTABLES ✓ bounty Critical
Malwarebytes Privacy (VPN) OTHER ✓ bounty Medium
Malwarebytes Remediation for CrowdStrike DOWNLOADABLE EXECUTABLES ✓ bounty Critical
Malwarebytes Support Tool (MBST) DOWNLOADABLE EXECUTABLES ✓ bounty Critical
Malwarebytes ToolSet (MBTS) DOWNLOADABLE EXECUTABLES ✓ bounty Critical
Malwarebytes Windows Firewall Control DOWNLOADABLE EXECUTABLES ✓ bounty Medium
MB4 (Malwarebytes 4) Beta OTHER ✓ bounty Critical
mta.malwarebytes.com URL ✓ bounty Critical
my.malwarebytes.com URL ✓ bounty Critical
myaccount-dev.malwarebytes.com URL ✓ bounty Critical
myaccount-stage.malwarebytes.com URL ✓ bounty Critical
nl.malwarebytes.com URL ✓ bounty Critical
oneview.malwarebytes.com URL ✓ bounty Critical
oneview.threatdown.com URL ✓ bounty Critical
org.malwarebytes.antimalware GOOGLE PLAY APP ID ✓ bounty Critical
partialshop.malwarebytes.com URL ✓ bounty Critical
pl.malwarebytes.com URL ✓ bounty Critical
press.blog.malwarebytes.com URL ✓ bounty Critical
press.malwarebytes.com URL ✓ bounty Critical
private-adwcleaner.malwarebytes.com URL ✓ bounty Critical
pt.malwarebytes.com URL ✓ bounty Critical
ru.malwarebytes.com URL ✓ bounty Critical
shop.malwarebytes.com URL ✓ bounty Critical
subscribe.malwarebytes.com URL ✓ bounty Critical
support.malwarebytes.com URL ✓ bounty Critical
tableau-mobile.dev.malwarebytes.com URL ✓ bounty Critical
telemetry.malwarebytes.com URL ✓ bounty Critical
ThreatDown Browser Phishing Protection OTHER ✓ bounty Critical
ThreatDown Device Control OTHER ✓ bounty Critical
ThreatDown Endpoint Detection & Response (EDR) OTHER ✓ bounty Critical
ThreatDown Endpoint Protection OTHER ✓ bounty Critical
ThreatDown Patch Management OTHER ✓ bounty Critical
tools.malwarebytes.com URL ✓ bounty Critical
www.malwarebytes.com URL ✓ bounty Critical
estore.malwarebytes.com URL out None
forums.malwarebytes.com URL submit only Critical
Malwarebytes Anti-Exploit DOWNLOADABLE EXECUTABLES submit only Medium
Malwarebytes Anti-Ransomware DOWNLOADABLE EXECUTABLES out None
malwarebytes.zoom.us URL out None
pages.malwarebytes.com URL out None
store.malwarebytes.com URL out None
store.threatdown.com URL out None
toolset.malwarebytes.com URL out None
USB Flash Drive Control DOWNLOADABLE EXECUTABLES submit only Medium
view.malwarebytes.com URL out None

HackerOne lists 97 scope entries. Its public listing groups many assets under one label, so we show identical entries once.