State of the market · updated live from approved reviews
The State of Bug Bounty
An aggregate read on how programs actually behave, built entirely from 9 researcher-submitted, admin-approved reviews across 8763 programs. No vendor self-reporting: every number below comes from people who actually filed reports.
8763
Programs rated
9
Approved reviews
5
Verified researchers
100%
Would submit again
Grade distribution
1 graded · 8762 not yet rated
A programs
1 · 100%
B programs
0 · 0%
C programs
0 · 0%
D programs
0 · 0%
F programs
0 · 0%
Time to first response
7 reviews reporting
Same day
0 · 0%
Within 3 days
5 · 71%
Within 2 weeks
0 · 0%
Within a month
0 · 0%
1–3 months
2 · 29%
Over 3 months
0 · 0%
Paid the advertised range?
5 reviews reporting
Paid the advertised range
4 · 80%
Paid below the range
1 · 20%
Did not pay fairly
0 · 0%
Most-reported practices
Top strengths
+
Credits researchers
6 reports
+
Clear, honest scope
6 reports
+
Responsive communication
4 reports
+
Clear, current policy
4 reports
+
Respectful & professional
4 reports
Top concerns
−
Slow to pay
4 reports
−
Downgrades severity
2 reports
−
Slow to first response
2 reports
−
Auto-closes valid reports
1 report
−
Disputes valid scope
1 report
Add to the data
Every review sharpens this picture.
These numbers only mean something because they came from researchers who actually filed reports. Rate a program you've worked with, good or bad.