Live aggregate
Bug bounty statistics
As of November 4, 2026, there are 1,801 public bug bounty and vulnerability disclosure programs across 7 platforms. 1,197 pay cash rewards, spanning 56,022 in-scope assets. The highest live payout is Bitmart Post-Incident Forensics Bounty Hunt at up to $58M.
- 1,801
- public programs
- 1,197
- paying cash rewards
- 56,022
- in-scope assets
- 7
- platforms indexed
Highest live payouts
Frequently asked
How many public bug bounty programs are there?
As of November 4, 2026, bounty.index tracks 1,801 public programs across 7 platforms. Of these, 1,197 pay cash rewards and 604 are vulnerability disclosure programs (no cash reward).
Which platforms does bounty.index cover?
HackerOne, Bugcrowd, Intigriti, YesWeHack, Immunefi, HackenProof, Federacy. 7 platforms in total, aggregated into one searchable index and updated daily.
What is the highest-paying bug bounty program right now?
The highest live maximum payout is Bitmart Post-Incident Forensics Bounty Hunt on HackenProof, paying up to $58M.
How many in-scope assets do these programs cover?
56,022 in-scope assets (domains, wildcards, APIs, mobile apps, source repositories, and more) across all tracked programs, as of November 4, 2026.
How often is the data updated, and is it free?
The index is rebuilt daily (last update: November 4, 2026). All data is free to browse, filter, export as CSV/JSON, and query via a public MCP endpoint for AI agents. No signup required.
