State of the market · updated live from approved reviews
The State of Bug Bounty
An aggregate read on how programs actually behave, built entirely from 4 researcher-submitted, admin-approved reviews across 17 programs. No vendor self-reporting — every number below comes from people who actually filed reports.
17
Programs rated
4
Approved reviews
1
Verified researchers
100%
Would submit again
Grade distribution
0 graded · 17 not yet rated
A programs
0 · 0%
B programs
0 · 0%
C programs
0 · 0%
D programs
0 · 0%
F programs
0 · 0%
Time to first response
3 reviews reporting
Same day
0 · 0%
Within 3 days
2 · 67%
Within 2 weeks
0 · 0%
Within a month
0 · 0%
1–3 months
1 · 33%
Over 3 months
0 · 0%
Paid the advertised range?
3 reviews reporting
Paid the advertised range
3 · 100%
Paid below the range
0 · 0%
Did not pay fairly
0 · 0%
Most-reported practices
Top strengths
+
Responsive communication
3 reports
+
Credits researchers
3 reports
+
Clear, honest scope
3 reports
+
Assigns CVEs
1 report
+
Fair on duplicates
1 report
Top concerns
−
Slow to first response
1 report
Add to the data
Every review sharpens this picture.
These numbers only mean something because they came from researchers who actually filed reports. Rate a program you've worked with — good or bad.