Report a Vulnerability
Submit, help fixing, get kudos.
Start a Bug Bounty
Run your bounty program for free.
533,494 coordinated disclosures
333,515 fixed vulnerabilities
784 bug bounties with 1,552 websites
15,924 researchers, 1099 honor badges Bug Bounty Program runs a bug bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of

Open Bug Bounty performs triage and verification of the submissions. However, we never intervene to the further process of vulnerability remediation and disclosure between and researchers.

Bug bounty program allow private and public submissions.

Bug Bounty Scope

The following websites are within the scope of the program:


Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

- Cross Site Scripting (XSS)
- Open Redirect

- Cross Site Request Forgery (CSRF)
- Improper Access Control

General Requirements: and are literally the same scripts on the same server. just filters out any conventions without anime there's no point to test both AND because if there's an issue on one site, it will be an issue on both...and when it's fixed on one, it will be fixed on both. don't even bother testing

Also, don't bother testing our forums either. We didn't write that software and will be turning that forum server off soon anyway. Any forum bug bounties that are logged will just be ignored. Don't waste your time or ours.

Testing Requirements:

Please don't keep slamming out submission forms over and over in attempts to find vulnerabilities. We've had some testers come to our site (perhaps with good intentions, but maybe looking for vulnerabilities they can exploit themselves) who have submitted garbage data to us literally THOUSANDS of times. All submitted data gets reviewed by a human being and doesn't get auto-posted...which means we have to go in and reject all those entries. If you do submit over 100 garbage form entries, don't be shocked if your IP gets blocked. please, don't keep slamming our submission forms.

Please don't use automated scanners like NexPloit.

Possible Awards:

Sorry, our sites don't bring in a lot of traffic and ad revenue barely pays the server bill so we're unable to offer any monetary rewards of any kind at this time.

Community Rating

Provided by security researchers who reported security vulnerabilities via this bug bounty program:

Response Time  How quickly researchers get responses to their submissions.
Remediation Time  How quickly reported submissions are fixed.
Cooperation and Respect  How fairly and respectfully researchers are being treated.

Researcher's comments

    13 May, 2020
Can't submit to this program and they banned my IP when I found an authentication bypass vulnerability in their sites.

  Latest Patched


  Latest Blog Posts

04.04.2020 by Rando02355205
(Alibaba) [IDOR] - [Bug Bounty]
12.03.2020 by Rando02355205
(Paypal) [CSP High Level] - [XSS Reflected] - [Bug Bounty] - [Write Up]
08.03.2020 by CybeReports XSS Vulnerability| CybeReports
29.02.2020 by Rando02355205
(Google) - [Stored XSS] - [Bug Bounty] - [WriteUp] - [24/02/2020]
10.02.2020 by 0xrocky
Stored XSS on

  Recent Recommendations

    26 May, 2020
Thank you Guarav! Very professional on checking our site for bugs and for providing the details in such a professional manner. We appreciate your help making our platform more secure
    26 May, 2020
Tested my site a lot (according to log :) and found an hidden XSS issue in our site.
Thank you!
    26 May, 2020
Very helpful insights, spotted something I'd overlooked.
    25 May, 2020
Thanks for finding this vulnerability for us. The corporate website is more secure now. Good job!
    25 May, 2020
Thank you for helping us to fix the critical SQL injection.
Friendly contact, thanks for the effort.