open dataset · CC-BY 4.0

Bug Bounty Program Directory

An open, machine-readable index of 900+ public bug-bounty programs — with the one thing most aggregators don't publish: verifiable provenance. Every record carries when we first saw it, when we last re-verified it, and a change history — and cites its official source.

Download JSON Download CSV

State of Bug Bounties — September 2026auto-generated from live data

909

Active programs

612

Paying bounties

$16k

Avg. max payout

$3.0M

Highest payout

+918

New (30d)

−15

Delisted (30d)

// top payouts

OpenSea Managed Bug Bounty Program · $3.0M Swiss Post - E-Voting · $230k Fireblocks MPC Managed Bug Bounty Engagement · $150k T-Mobile · $134k Tesla · $100k

report.json →

Methodology

Programs are aggregated from public directories of major coordination platforms.
The set is re-synced every ~6 hours; each program's last_verified timestamp is updated on every run.
When a tracked field changes (payout range, scope count, managed status) we append an entry to that program's change_history.
Programs that disappear from their source are marked delisted_at rather than deleted, so the history stays intact.
hacking.community does not host or operate these programs — each record links to its official page as the authoritative source.

Fields

nameProgram name

platformHost platform (HackerOne, Bugcrowd, Intigriti, YesWeHack…)

urlOfficial program page (source citation)

offers_bountiesWhether the program pays monetary bounties

min_bounty / max_bountyPublished payout range, when disclosed

managedWhether the program is platform-managed

scope_countNumber of assets in scope

first_seenFirst date we observed the program

last_verifiedMost recent date we re-verified it against the source

change_historyPer-field change log (payouts, scope, delisting)

License & citation

Released under Creative Commons Attribution 4.0. Free to use — please cite:

hacking.community, “Bug Bounty Program Directory (Open Dataset),” https://hacking.community/programs/dataset