Bug bounty platforms, methodology, report templates, and payout references. Includes interactive platform comparison widget (5 platforms, 10 criteria) and platform trust notes.
Interactive comparison of the 5 major platforms: access model, selection process, payout, triage quality, GDPR compliance, community, and specialties. Click a column to highlight, search to filter.
| Platform | Scope | Payout Range | Notes |
|---|---|---|---|
| HackerOne | Public + Private | $50 - $100k+ | Largest platform, corporate + gov programs |
| Bugcrowd | Public + Private | $50 - $50k+ | VRT taxonomy, coordinated disclosure |
| Intigriti | Public + Private | EUR 50 - EUR 50k+ | Europe-focused, triage team |
| YesWeHack | Public + Private | EUR 50 - EUR 50k+ | French/EU platform, DORA compliance |
| Synack | Invite-only | $500 - $100k+ | Red Team only, vetted researchers |
| Immunefi | Web3/DeFi | $1k - $10M+ | Smart contracts, blockchain, DeFi |
| Platform | Focus |
|---|---|
| Open Bug Bounty | Non-profit, XSS/CSRF focused |
| Cobalt | PtaaS + bug bounty hybrid |
| HackenProof | Crypto/blockchain projects |
| Federacy | Startups and SMBs |
| Yogosha | EU, private programs |
| SafeHats | India-focused |
| BugBase | India-focused |
| Vulnerability Lab | Research-oriented |
HackerOne : insider threat in 2022 (employee stole and resold vulnerability reports), researcher "ghosted" on $8,500 bounty (Jan 2026), employee data breach via supplier Navia (Mar 2026, SSNs and health data exposed), IBB program paused due to AI flooding (Mar 2026). Remains the largest platform but be aware of these incidents.
TryHackMe : not a bug bounty platform but often listed as a training recommendation. Intentionally excluded - see Learning Platforms for details on the AI data controversy.
YesWeHack, Intigriti, Bugcrowd, Synack : no major public scandals or trust incidents found as of April 2026.
# Subdomain enumeration
subfinder -d target.com -all | httpx
amass enum -d target.com -passive
# JS file analysis
katana -u https://target.com -jc
linkfinder -i https://target.com/app.js -o cli
# Parameter discovery
arjun -u https://target.com/api/
paramspider -d target.com
# Directory brute
ffuf -u https://target.com/FUZZ -w wordlist.txt
feroxbuster -u https://target.com -w seclists/...
| Class | Severity | Typical Payout |
|---|---|---|
| RCE | Critical | $5k - $100k |
| SQLi | High/Crit | $2k - $30k |
| Auth Bypass | High | $2k - $20k |
| SSRF | Medium/High | $1k - $15k |
| IDOR | Medium/High | $500 - $10k |
| XSS (Stored) | Medium | $500 - $5k |
| XSS (Reflected) | Low/Med | $100 - $2k |
| CSRF | Low/Med | $100 - $1k |
| Info Disclosure | Low | $50 - $500 |
| Open Redirect | Low | $50 - $300 |
| Score | Rating |
|---|---|
9.0 - 10.0 |
Critical |
7.0 - 8.9 |
High |
4.0 - 6.9 |
Medium |
0.1 - 3.9 |
Low |
0.0 |
None |
## Title
[Vuln Type] in [Feature] allows [Impact]
## Summary
Brief description of the vulnerability.
## Severity
CVSS: X.X (Critical/High/Medium/Low)
CWE: CWE-XXX
## Steps to Reproduce
1. Navigate to https://target.com/...
2. Intercept the request with Burp
3. Modify parameter X to Y
4. Observe the response
## Impact
What an attacker can achieve:
- Data exfiltration
- Account takeover
- Privilege escalation
## Proof of Concept
[Screenshot / HTTP request-response]
## Remediation
Suggested fix for the development team.
## References
- CWE-XXX: ...
- OWASP: ...
robots.txt, security.txt, /.well-known/