Infosec Institute

Open Bug Bounty mentioned in the
Top 6 Bug Bounty programs of
2022 by the InfoSec Institute

The Hacker News

Open Bug Bounty named among the
Top 5 Bug Bounty programs of 2021
by The Hacker News

All Open Bug Bounty emails are sent only from domain being digitally signed. All others are fake. Learn more.
For security researchers
Report a Vulnerability
Submit, help fixing, get kudos.
For website owners
Start a Bug Bounty
Run your bounty program for free.
1,491,101 coordinated disclosures
1,172,090 fixed vulnerabilities
1,769 bug bounty programs, 3,499 websites
35,514 researchers, 1,571 honor badges

Terms of Usage

All users of the non-profit Open Bug Bounty project must always: (i) respect all other users of the project, (ii) comply with laws of its own country and countries where they operate while using the Open Bug Bounty website, and (iii) attentively read the Frequently Asked Questions and carefully follow the guidelines provided on this website.

Violation of the guidelines or of the present terms may lead to permanent suspension of user account without any compensation of any kind. Open Bug Bounty reserves the right to reject any user or hosted bug bounty program at its sole discretion.

Open Bug Bounty website may contain links to third-party websites. These links are provided only as a matter of convenience. Open Bug Bounty shall never be liable for content, products, services or opinions available on those websites.

By using Open Bug Bounty you unconditionally agree that: (i) Open Bug Bounty shall never be liable, accountable or responsible for any behavior or activities of its users, (ii) all features of the Open Bug Bounty website and any other functionalities are provided “as is” without any implied or express warranty of any kind, and (iii) you shall be solely liable for your usage of Open Bug Bounty project in compliance with applicable law.

If you disagree with any of these terms, you are kindly required to leave this website.

Privacy Policy and Data Security

Open Bug Bounty does not store, process or export any Personally Identifiable Information (PII) as defined in General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679).

To avoid storing user-related data, we use external authentication via Twitter for everyone on the website and on our forum. Connection to the website is available via HTTPS only. To enhance privacy, Open Bug Bounty keeps no logs of any activities of website owners or security researchers.

Open Bug Bounty does not transfer any vulnerabilities or vulnerability-related data to any third-parties. Open Bug Bounty undertakes reasonable efforts to maintain data security and availability of it website, however, it shall never be liable for any issues related thereto.

  Latest Patched


  Latest Blog Posts

16.01.2023 by itsvarmakollu
XSS vulnerabilities discovered in ServiceNow - CVE-2022-38463
16.01.2023 by itsvarmakollu
Turning cookie-based XSS into account takeover
08.07.2022 by 4websecurity
CVE 2022-29455 is still affecting millions of Wordpress sites
08.07.2022 by kh4sh3i_
Zabbix - SAML SSO Authentication Bypass
08.07.2022 by FR13ND0x7F
The Time Machine — Weaponizing WaybackUrls for Recon, BugBounties , OSINT, Sensitive Endpoints and what not

  Recent Recommendations

@DelganGeor63536     26 May, 2023
    Twitter DelganGeor63536:
navreet1425 was professional in his vulnerability disclosure.I really appreciates his work.
@Harpree66584431     26 May, 2023
    Twitter Harpree66584431:
Thank you for finding vulnerability in our website
@MinasPergantis     23 May, 2023
    Twitter MinasPergantis:
Thank you for your help in ensuring the security of our domain and its visitors! Your contributions are invaluable.
@franky1302     17 May, 2023
    Twitter franky1302:
Thanks Khan Janny for letting us know and fix the issue.
@BenjaminSponsor     11 May, 2023
    Twitter BenjaminSponsor:
Thanks for making me aware Alex!