Infosec Institute

Open Bug Bounty mentioned in the
Top 6 Bug Bounty programs of
2022 by the InfoSec Institute

The Hacker News

Open Bug Bounty named among the
Top 5 Bug Bounty programs of 2021
by The Hacker News

Platform update: please use our new authentication mechanism to securely use the Open Bug Bounty Platform.
For security researchers
Report a Vulnerability
Submit, help fixing, get kudos.
For website owners
Start a Bug Bounty
Run your bounty program for free.
1,711,157 coordinated disclosures
1,387,171 fixed vulnerabilities
2,003 bug bounty programs, 3,907 websites
47,855 researchers, 1,654 honor badges

Terms of Usage

All users of the non-profit Open Bug Bounty project must always: (i) respect all other users of the project, (ii) comply with laws of its own country and countries where they operate while using the Open Bug Bounty website, and (iii) attentively read the Frequently Asked Questions and carefully follow the guidelines provided on this website.

Violation of the guidelines or of the present terms may lead to permanent suspension of user account without any compensation of any kind. Open Bug Bounty reserves the right to reject any user or hosted bug bounty program at its sole discretion.

Open Bug Bounty website may contain links to third-party websites. These links are provided only as a matter of convenience. Open Bug Bounty shall never be liable for content, products, services or opinions available on those websites.

By using Open Bug Bounty you unconditionally agree that: (i) Open Bug Bounty shall never be liable, accountable or responsible for any behavior or activities of its users, (ii) all features of the Open Bug Bounty website and any other functionalities are provided “as is” without any implied or express warranty of any kind, and (iii) you shall be solely liable for your usage of Open Bug Bounty project in compliance with applicable law.

If you disagree with any of these terms, you are kindly required to leave this website.

Privacy Policy and Data Security

Open Bug Bounty does not store, process or export any Personally Identifiable Information (PII) as defined in General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679).

To avoid storing user-related data, we use authentication via OTP for everyone on the website and on our forum. Connection to the website is available via HTTPS only. To enhance privacy, Open Bug Bounty keeps no logs of any activities of website owners or security researchers.

Open Bug Bounty does not transfer any vulnerabilities or vulnerability-related data to any third-parties. Open Bug Bounty undertakes reasonable efforts to maintain data security and availability of it website, however, it shall never be liable for any issues related thereto.









  Latest Patched

 22.05.2024 ceza.gov.ph
 22.05.2024 cavenders.com
 21.05.2024 expresscar.am
 21.05.2024 opera.am
 20.05.2024 tcim.cuhk.edu.hk
 20.05.2024 attendance.dghs.gov.bd
 20.05.2024 land.gov.bd
 20.05.2024 dashboard.dghs.gov.bd

  Latest Blog Posts

04.12.2023 by BAx99x
Unmasking the Power of Cross-Site Scripting (XSS): Types, Exploitation, Detection, and Tools
04.12.2023 by a13h1_
$1120: ATO Bug in Twitter’s
04.12.2023 by ClumsyLulz
How I found a Zero Day in W3 Schools
04.12.2023 by 24bkdoor
Hack the Web like a Pirate: Identifying Vulnerabilities with Style
04.12.2023 by 24bkdoor
Navigating the Bounty Seas with Open Bug Bounty

  Recent Recommendations

    22 May, 2024
    AndySchmidt:
Rajesh pointed out two different important vulnerabilities and supplied the necessary details for us to reproduce the issues. We appreciate his professionalism throughout the process.
    14 May, 2024
    TheDevinSwan:
Thank you for reporting vulnerabilities on our site. Your prompt assistance enabled us to resolve the issue quickly.
    1 May, 2024
    Mek:
Got a recommendation to fix an SQL injection vulnerability on my website. As I am a hobbyist and my page is a hobby project, I can't offer money, so I am recommending this researcher. Thanks again.
    26 April, 2024
    I_bims_Mike:
Thank you very much for identifying the XSS vulnerability and for our friendly email exchange.
    22 April, 2024
    genoverband:
Thank you for your invaluable help in ensuring the security of our domain and its visitors!