About
Researcher ratings for bug bounty programs
BugRater is an independent directory that rates bug bounty and vulnerability disclosure programs based on what the researchers who work them report: triage speed, payout fairness, communication, scope honesty, and whether they'd submit to that program again.
Why balanced reviews
A site full of complaints tells you which programs to avoid. Good reviews are as useful, because they point you to programs that respond fast and pay fairly. We collect both through one standardized form, so ratings are comparable and a grade means the same thing for every program.
How grades are computed
Each program gets a letter grade from a weighted score of reported outcomes: would-submit-again rate, whether it pays its advertised range, payout fairness, median time to first response, communication, and acceptance rate. Reviews from researchers who've verified a platform account count double. A program needs at least 3 reviews before it gets a grade.
Moderation
Every review comes from an account holder and is moderated before it's published. Ratings summarize what reviewers reported. We do not endorse programs. Programs can claim their profile to respond on the record.
What we won't do
We've written down what we will and won't do. For example, we will not ask for a government ID, and we don't handle any money paid between a researcher and a program. Read our founding principles.