djadmin/awesome-bug-bounty

Bug bounty programs are arrangements where companies invite independent security researchers to find and report vulnerabilities in their software, and pay out rewards for valid findings. This repository is a curated reference list for people who want to participate in these programs, compiled from publicly available sources. The list is organized into four sections. The first is a getting-started section with links to introductory articles about how bug bounty hunting works as a practice. The second is a collection of write-ups from individual researchers, each linked to their personal blog or write-up archive, showing real examples of the kinds of vulnerabilities people have found and how they found them. Reading write-ups is a common way for new researchers to learn techniques and understand what constitutes a reportable finding. The third section lists the major platforms that host bug bounty programs on behalf of companies, such as HackerOne, Bugcrowd, Intigriti, Cobalt, Synack, and others. These platforms act as intermediaries, handling submission, triage, and payment between researchers and companies. The fourth and largest section is an alphabetical list of individual company programs, with a link to each company's submission page, email address, or platform profile. It covers hundreds of organizations ranging from major tech companies to smaller services. This repository has no code. It is a plain Markdown file maintained as an open reference. Anyone can contribute by submitting a pull request to add a newly launched program or a write-up that is not yet listed. The README contains a link to contributing guidelines for those who want to help keep the list current.