001
0xKYC may be required
Web3
Paid — see policy
↗︎OPEN • PAID • PUBLICOFFICIAL EVIDENCE ONLY
Bug bounties,
without the dead ends.
A source-linked record of vulnerability programs last observed as public and paid. Every listing points to an official platform or the organization’s own policy—not a copied aggregator page. Live-permitted sources are rechecked every 12 hours; retained snapshots stay visibly dated.
INDEX HEALTHPARTIAL
1087
source-linked public listings
- First-party policies
- 47
- Source groups
- 9
- Last attempt
- 0m ago
- Complete live inventories
- 2 / 9
01 / DIRECTORY
Find your next scope.
1087 matching programs
ProgramEvidenceSurfacePublished reward
002
1inch - AquaKYC may be required
Web3
Paid — see policy
↗︎003
1inch - Aqua ImprovementKYC may be required
Web3
Paid — see policy
↗︎004
1inch - BusinessKYC may be required
Web3
Paid — see policy
↗︎005
1inch - InfrastructureKYC may be required
Web3
Paid — see policy
↗︎006
1inch - Smart ContractsKYC may be required
Web3
Paid — see policy
↗︎007
1inch - WalletKYC may be required
Web3
Paid — see policy
↗︎008
1inch - WebKYC may be required
Web3
Paid — see policy
↗︎009
Web3
Paid — see policy
↗︎Web3
Paid — see policy
↗︎Web3
Paid — see policy
↗︎Web3
Paid — see policy
↗︎013
Web3
Paid — see policy
↗︎014
Web3
Paid — see policy
↗︎Mixed
Paid — see policy
↗︎Products
Paid — see policy
↗︎017
Mixed
Paid — see policy
↗︎018
Web & cloud
Paid — see policy
↗︎Mixed
Paid — see policy
↗︎020
Mixed
Paid — see policy
↗︎021
Mixed
Paid — see policy
↗︎022
3F GruntKYC may be required
Web3
Paid — see policy
↗︎Web3
Paid — see policy
↗︎024
Mixed
Paid — see policy
↗︎025
Mixed
Paid — see policy
↗︎026
AAVEKYC may be required
Web3
Paid — see policy
↗︎Web3
Paid — see policy
↗︎028
Web3
Paid — see policy
↗︎Mixed
Paid — see policy
↗︎030
Web3
Paid — see policy
↗︎Web3
Paid — see policy
↗︎Web & cloud
Paid — see policy
↗︎033
Mixed
Paid — see policy
↗︎Web3
Paid — see policy
↗︎Web3
Paid — see policy
↗︎Web3
Paid — see policy
↗︎037
AeraKYC may be required
Web3
Paid — see policy
↗︎038
Web3
Paid — see policy
↗︎039
Mixed
Paid — see policy
↗︎Web & cloud
Paid — see policy
↗︎041
Web3
Paid — see policy
↗︎Web & cloud
Paid — see policy
↗︎Web & cloud
Paid — see policy
↗︎044
Mixed
Paid — see policy
↗︎Web & cloud
Paid — see policy
↗︎046
Mixed
Paid — see policy
↗︎047
Mixed
Paid — see policy
↗︎Web & cloud
Paid — see policy
↗︎02 / SOURCE COVERAGE
Traceable by design.
No community aggregator is accepted as evidence.
01
HackerOne
Live directory 2026-10-05
221live
↗︎02Bugcrowd
Snapshot 2026-08-06 · permission-limited
241retained / partial
↗︎03Intigriti
Snapshot 2026-08-06 · permission-limited
82retained / partial
↗︎04YesWeHack
Snapshot 2026-08-06 · permission-limited
62retained / partial
↗︎05HackenProof
Snapshot 2026-08-06 · permission-limited
159retained / partial
↗︎06Immunefi
Snapshot 2026-08-06 · permission-limited
187retained / partial
↗︎07Cantina
Snapshot 2026-08-06 · permission-limited
51retained / partial
↗︎08Sherlock
Live directory 2026-10-05 · 39 raw → 37 unique
37live
↗︎09First-party
47/60 eligible · 30 reachable · 4 failure types
47retained / partial
↗︎03 / METHOD
What “open” means here.
There is no universal registry for bug bounties. This index treats completeness as a verifiable process: cover authoritative directories, follow first-party disclosures, and keep uncertainty visible.
- 01
Money is explicit
Reward language or a bounty table must be present. Unpaid VDPs are excluded.
- 02
The door is open
Public submission must be available now. Private, paused, invite-only, and ended programs are excluded.
- 03
Evidence is primary
Accepted evidence is an official platform page or the organization’s own domain.
- 04
Failures remain visible
A source outage never silently deletes a program. Permission-gated directories stay labeled as snapshots instead of being crawled against their rules.
- 05
Records stay minimal
Platform descriptions, scopes, logos, and reward tables are not reproduced. Follow the official link for current terms.