Your next program.
Beyond the platforms.
Public bug bounty programs run by the organisations themselves, found by reading what they publish about themselves. Find a policy. Read the scope. Then start your research.
/
| Program | Reward | Safe harbour | Status | Record |
|---|
Reading this data
- Self-hosted means the program names no bug bounty platform, so it does not appear in platform-derived datasets. It says nothing about whether the program is large or small.
- Safe harbour is detected from the linked policy document. Not stated means we read the policy and found no protective language — not that testing is forbidden. Unknown means no policy document was reachable.
- Reward runs pays (money) → swag (gifts) (a shirt, stickers, something posted to you) → hall of fame (credit only) → none stated, ordered by what actually reaches you.
- Status — expired means the organisation's own
Expiresdate has passed, so it considers the policy stale. Retired means the file is no longer served; the record is kept rather than deleted so its disappearance is visible. - Registry region is read from the domain's TLD, not from where the
organisation operates or is incorporated. A
.aidomain is filed under Anguilla and a.iounder the British Indian Ocean Territory because that is whose registry issued it; generic TLDs like.comcarry no region at all. - Reward and safe-harbour are automated triage, not a legal reading. Always read the policy yourself before testing anything.