appsec.fyi

Bug Bounty Resources

Post Share

A curated AppSec resource library covering XSS, SQLi, SSRF, IDOR, RCE, XXE, OSINT, and more.

Bug Bounty

A bug bounty program is a deal offered by organizations and software developers by which individuals can receive recognition and compensation for reporting security vulnerabilities. These programs have become a critical component of modern security strategies, with platforms like HackerOne, Bugcrowd, and Intigriti connecting thousands of researchers with companies that want their products tested.

Bug bounty hunting requires a broad skill set — from reconnaissance and attack surface mapping to deep technical knowledge of specific vulnerability classes. Successful hunters understand not just how to find bugs, but how to demonstrate impact, write clear reports, and communicate effectively with security teams. The difference between a duplicate and a high-severity payout often comes down to the depth of investigation and quality of the proof of concept.

The bug bounty ecosystem has matured significantly. Programs range from public programs open to anyone to private, invite-only programs for experienced researchers. Payouts vary from a few hundred dollars for low-severity issues to six-figure rewards for critical vulnerabilities in high-value targets. Many researchers treat bug bounty as a full-time career, while others use it to sharpen their skills alongside traditional security roles.

Key topics include choosing targets, managing scope, avoiding duplicates, writing effective reports, and understanding triage processes across different platforms.

This page collects bug bounty resources, methodologies, success stories, and guides for both beginners and experienced hunters.

From Wikipedia

Date Added Link Excerpt
2026-04-29 NEW 2026Bug bounty isnt dead but the old model is breaking beginnerAnalysis of the bug bounty model's evolution, discussing the impact of AI on report generation and validation costs, leading to programs like IBB pausing submissions and curl removing payouts. It highlights the shift from incentivized disclosure to expected disclosure, with a potential focus on more targeted rewards and better security outcomes rather than sheer report volume. → aikido.dev
2026-04-24 NEW 2026GPT-5.5 Bio Bug Bounty Program Aims to Improve AI Safety and Performance news AIOpenAI has launched a bug bounty program for its GPT-5.5 Bio model, seeking to enhance AI safety and performance. The program encourages researchers to identify and report vulnerabilities. Details about specific payout amounts are not provided in the content. The initiative aims to proactively address potential issues before widespread deployment. → gbhackers.com
2026-04-24 NEW 2026Claude Mythos discovered 271 vulnerabilities in Firefox news FuzzingClaude Mythos identified a significant number of vulnerabilities in the Firefox browser, totaling 271. This extensive discovery highlights potential security weaknesses within the popular web browser. → secnews.gr
2026-04-23 NEW 2026AI Sparks Bug-Bounty Surge in Crypto but Low-Quality Reports Grow newsAnalysis of AI's impact on crypto bug bounties reveals a 900% submission surge, leading to increased noise and false positives. Tools like curl's creator Daniel Stenberg have ceased programs due to AI-generated "slop." HackerOne reported an 7% rise in valid submissions in 2025. Cosmos Labs and Komodo Platform are adapting by tightening scoring, prioritizing trusted researchers, and exploring defensive AI for triage to manage the influx of low-quality reports and maintain program sustainability.
2026-04-22 2026Whos Really to Blame When a White Hat Goes Gray? newsWriteup exploring the ethical considerations of vulnerability disclosure programs, questioning who bears responsibility when a researcher, frustrated by a company's slow or dismissive process, publicly releases exploit code. It argues that while releasing exploit code prematurely is unethical due to potential harm to users, companies also have a duty of care to foster credible, fair, and respectful disclosure processes to encourage responsible disclosure and prevent vulnerabilities from being weaponized.
2026-04-22 2026Nextcloud ends bug bounty program due to too many low-quality reports newsNews about Nextcloud ending its bug bounty program due to an influx of low-quality, AI-generated vulnerability reports. Financial rewards are discontinued for all submissions, even critical ones, impacting the HackerOne platform. Valid reports will still be accepted but will not receive compensation. → techzine.eu
2026-04-22 2026The Unofficial HackerOne Disclosure Timeline newsThe Unofficial HackerOne Disclosure Timeline
2026-04-22 2026Publicly Disclosed HackerOne Bug Bounty Findings newsPublicly Disclosed HackerOne Bug Bounty Findings
2026-04-22 2026GraphQL - PortSwigger Lab Writeup intermediateWriteup detailing GraphQL vulnerabilities and exploitation techniques. It covers bypassing introspection query regex validation, brute-forcing logins using aliases to circumvent rate limiting, and performing CSRF by converting requests to `x-www-form-urlencoded`. The entry also demonstrates how to find hidden GraphQL endpoints using directory fuzzing with Gobuster.
2026-04-22 2026BugBoard: Searchable Bug Bounty Writeups newsBugBoard: Searchable Bug Bounty Writeups
2026-04-22 2026AI Vulnerability Deep Dive: Prompt Injection (Bugcrowd) intermediateAI Vulnerability Deep Dive: Prompt Injection (Bugcrowd) → bugcrowd.com
2026-04-22 2026A Guide to the Hidden Threat of Prompt Injection (Bugcrowd) beginnerA Guide to the Hidden Threat of Prompt Injection (Bugcrowd) → bugcrowd.com
2026-04-22 2026Writeups for Hack The Box Bug Bounty CTF 2025 newsWriteups for Hack The Box Bug Bounty CTF 2025
2026-04-22 2026Bug-Bounty-Methodology: JWT and Other Vulnerability Classes intermediateBug-Bounty-Methodology: JWT and Other Vulnerability Classes
2026-04-22 2026Bug Bounty Writeups: Available Programs and Writeups newsWriteups collection featuring bug bounty programs and detailed writeups on various vulnerabilities, including XSS, CSRF, LFI, SQL injection, IDOR, 2FA bypass, SSRF, RCE, XXE, insecure deserialization, business logic flaws, SSTI, directory traversal, WebSockets attacks, cache poisoning, and information disclosure. It also lists specific techniques and bypasses for WAFs and SQL injection.
2026-04-22 2026Awesome Google VRP Writeups newsWriteups from the Google VRP Bug Bounty program offer detailed insights into real-world vulnerabilities and exploitation techniques. These entries cover a spectrum of security issues, including remote command execution in Google Cloud products, IDOR vulnerabilities, privilege escalation chains, cross-site scripting (XSS) in various Google services like IDX and Gmail, and client-side RCE in Google Web Designer. Specific CVEs like CVE-2025-12080 and CVE-2025-4613 are mentioned, alongside vulnerabilities in Gemini, Looker, and Apigee.
2026-04-22 2026AI Sparks Bug-Bounty Surge in Crypto but Low-Quality Reports Grow newsAnalysis of AI's impact on bug bounty programs reveals a 900% submission volume increase, leading to noise and false positives for protocols like Cosmos Labs and Komodo Platform. This trend, observed with tools like curl and platforms like HackerOne, necessitates more stringent triage and verification workflows, with potential solutions including defensive AI for filtering reports and prioritizing trusted researchers. The challenge lies in balancing AI-driven discovery with manageable review workloads.
2026-04-20 2026Meta and PortSwigger drive offensive security further to find what others miss newsLibrary. This partnership between Meta Bug Bounty and PortSwigger integrates Meta’s bug bounty program with Burp Suite Professional, aiming to enhance vulnerability discovery and researcher skills. Selected HackerPlus Silver league researchers receive Burp Suite Professional licenses to leverage its technical capabilities alongside Meta's collaborative program, fostering improved tooling and education for the security community. → helpnetsecurity.com
2026-04-20 2026Dark web forum hosts $10000 article contest on vulnerability exploitation newsWriteup of a $10,000 vulnerability exploitation contest hosted by the dark web forum TierOne. The contest, running from April 13 to May 14, 2026, incentivizes original research on remote code execution (RCE), command injection, IDOR, SSTI, router/camera firmware exploitation, privilege escalation, and zero-days in browser components. Submissions can also focus on exploiting Cisco or Oracle products, AI-assisted discovery, and bypassing AV/EDR systems. → scworld.com
2026-04-19 2026Bug-bounty Writeups Repository — fardeen-ahmed intermediateBug-bounty Writeups Repository — fardeen-ahmed
2026-04-19 2026Top Bugs That Actually Paid Bounties in 2025 beginnerTop Bugs That Actually Paid Bounties in 2025
2026-04-16 2026PayloadsAllTheThings: Server Side Request Forgery beginner SSRFReference detailing Server Side Request Forgery (SSRF) vulnerabilities, including methodologies for bypassing filters, exploiting localhost access via IPv6 notation, domain redirects, CIDR, rare addresses, encoded IPs, URL parsing discrepancies, PHP filter_var(), and the JAR scheme. It covers exploitation via URL schemes, blind exploitation, and upgrading to XSS, referencing tools like swisskyrepo/SSRFmap, tarunkant/Gopherus, In3tinct/See-SURF, teknogeek/SSRF-Sheriff, assetnote/surf, dwisiswant0/ipfuscator, and Horlad/r3dir. The entry also explores accessing cloud metadata, leaking files, network discovery, and sending packets to services for RCE.
2026-04-16 2026BugHunterMethodology: A Comprehensive Bug Bounty Methodology beginnerMethodology offering a structured bug bounty approach, including web app reconnaissance, a comprehensive workflow for identifying, analyzing, and exploiting vulnerabilities, detailed checklists, common payloads, and bypass techniques. It also features tricks and advanced methods to enhance bug hunting efficiency and effectiveness.
2026-04-16 2026PortSwigger's Top 10 Web Hacking Techniques of 2025 beginnerReference listing the top 10 web hacking techniques of 2025, curated by an expert panel from community nominations. Techniques include Parser Differentials, Playing with HTTP/2 CONNECT, XSS-Leak, Next.js cache poisoning, Cross-Site ETag Length Leak, SOAPwn (RCE via HttpWebClientProtocol flaw), Unicode normalization attacks like "Lost in Translation," blind SSRF visibility techniques, ORM leaks, and "Successful Errors" for blind server-side template injection. The analysis highlights trends in side-channel attacks and new exploitation primitives. → portswigger.net
2026-04-16 2026Automating Bug Bounties with Nuclei intermediateAutomating Bug Bounties with Nuclei
2026-04-16 2026Advanced Techniques & Use Cases of Nuclei for Bug Bounty advancedAdvanced Techniques & Use Cases of Nuclei for Bug Bounty → osintteam.blog
2026-04-16 2026Crafting Your Bug Bounty Methodology: A Complete Guide beginnerGuide for beginner bug bounty hunters detailing how to craft a personalized methodology. It emphasizes mastering fundamentals like HTTP and OWASP Top 10, identifying personal strengths (e.g., front-end development for XSS, database knowledge for SQLi), and continuous practice. The guide suggests focusing on specific vulnerability classes or target types, leveraging tools like proxies, and developing reusable checklists or scripts to improve efficiency and find unique vulnerabilities. → intigriti.com
2026-04-16 2026Top Vulnerabilities for Pentest & Bug Bounty in 2025 beginnerLibrary of advanced web security techniques for bug bounty hunters in 2025, focusing on vulnerabilities beyond basic payloads. It details methodologies for Cross-Site Scripting (XSS), including blind XSS and cross-domain implications, and Server-Side Request Forgery (SSRF), emphasizing in-depth analysis of application functionality and local environment replication, advising against tools like Burp Collaborator for testing. The resource also covers Path Traversal, stressing URL encoding mastery and API call testing, and Web Cache Deception, highlighting the identification of sensitive data endpoints, testing file extensions, and analyzing caching headers for exploitation opportunities.
2026-04-14 2026UIDAI launches bug bounty program to secure Aadhaar ecosystem newsProgram launched by the Unique Identification Authority of India (UIDAI) to secure its Aadhaar ecosystem. This bug bounty initiative engages 20 security researchers to identify vulnerabilities in platforms like the official website and myAadhaar portal, classifying them into Critical, High, Medium, and Low tiers with tiered rewards. UIDAI collaborates with ComOlho IT Private Limited for program management and vulnerability handling, mirroring practices of global tech firms and complementing existing government cybersecurity efforts. → scworld.com
2026-04-11 2026UIDAI Bug Bounty Program to Boost Aadhaar Cybersecurity newsLibrary and framework for enhancing the cybersecurity of India's Aadhaar ecosystem through a structured bug bounty program. This initiative enlists independent cybersecurity professionals and ethical hackers to identify vulnerabilities across critical digital platforms like the official UIDAI website, myAadhaar portal, and the Secure QR Code application. Managed in collaboration with ComOlho IT Private Limited, the program categorizes reported flaws into Critical, High, Medium, and Low risk tiers, offering rewards based on severity, and aligns with broader Indian government bug bounty efforts by CERT-In and NCIIPC. → thecyberexpress.com
2026-04-10 2026Intigriti: Exploiting JWT vulnerabilities — advanced exploitation guide advanced API Sec JWTGuide detailing advanced exploitation techniques for JSON Web Tokens (JWTs), covering vulnerabilities arising from misconfigurations and improper input validation. It explains how flaws in handling the 'none' algorithm, missing signature validation, algorithm confusion attacks, and JWK spoofing (including CVE-2018-0114) can lead to authentication bypasses and injection attacks, emphasizing the importance of secure implementation practices. → intigriti.com
2026-04-10 2026Writeups - Pentester Land intermediateWriteups - Pentester Land
2026-04-10 2026The Unfiltered 2025 Guide to Web Pentesting & Bug Bounties beginnerThe Unfiltered 2025 Guide to Web Pentesting & Bug Bounties
2026-04-10 2026Recon to Master: Complete Bug Bounty Checklist beginner ReconRecon to Master: Complete Bug Bounty Checklist
2026-04-10 2026Awesome Bug Bounty Tools - GitHub beginner Recon XXELibrary of curated bug bounty tools for identifying vulnerabilities such as Command Injection, CORS Misconfiguration, Directory Traversal, Insecure Deserialization, and SQL Injection. This repository includes numerous subdomain enumeration utilities like Sublist3r, Amass, and Findomain, alongside port scanners like masscan and RustScan, and web screenshotting tools like EyeWitness and gowitness. It also features technology identification tools such as Wappalyzer and whatweb, and content discovery tools like gobuster and feroxbuster.
2026-04-10 2026Bug Bounty Hunter Software in 2026: What Belongs in Your Stack beginnerLibrary for composing a bug bounty hunting software stack in 2026, emphasizing the need for tools that manage traffic, map assets, generate coverage, validate signals, and create evidence. It highlights that modern bug bounties require a layered approach rather than a single solution, with specific mentions of Burp Suite for traffic control, ProjectDiscovery tools for recon, OWASP Amass for asset mapping, and Nuclei for template-based coverage, acknowledging shifts towards AI vulnerabilities and broken access control. → penligent.ai
2026-04-10 2026How I'd Start Bug Bounty Hunting in 2026: A 90-Day Plan beginnerHow I'd Start Bug Bounty Hunting in 2026: A 90-Day Plan
2026-04-10 2026Backend Mastery: The Real Bug Bounty Superpower (2026) beginnerBackend Mastery: The Real Bug Bounty Superpower (2026)
2026-04-10 2026Fix Your Bug Bounty Strategy: The 2026 Blueprint beginnerLibrary for strategic bug bounty hunting, this resource details a 2026 blueprint to overcome common pitfalls like "spray and pray" tactics and tool overload. It emphasizes a surgeon-like mindset focusing on depth over breadth, automating intelligence gathering, and understanding application logic through the "Asset DNA" model. The framework's three pillars include hyper-targeted recon focusing on functionality and change detection, mastering a specific attack vector, and using automation to build intelligent workflows rather than just discovery. It suggests techniques for identifying vulnerable areas by reverse-engineering business logic and prioritizing new code for testing.
2026-04-10 2026How I Started a Bug-Bounty Career in 2026 beginnerHow I Started a Bug-Bounty Career in 2026
2026-04-10 2026Bug Bounty Hunting Methodology 2025 - Amr Elsagaei beginnerMethodology for bug bounty hunting, detailing foundational steps in reconnaissance, enumeration, and testing. This guide assists cybersecurity enthusiasts in uncovering subdomains, analyzing JavaScript files, and identifying high-impact vulnerabilities. The approach serves as a starting point and blueprint for navigating targets, with ample room for skill growth.
2026-04-10 2026Bug Bounty Hunting in 2026 - DEV Community beginnerGuide to bug bounty hunting detailing prerequisites, environment setup, learning paths, and platforms. It covers common vulnerability types like XSS and SQL Injection, recommends tools such as subfinder, httpx, nuclei, and ffuf, and discusses techniques for finding bugs and writing effective reports for programs like HackerOne and Bugcrowd, aiming to help researchers earn income by discovering vulnerabilities.
2026-04-10 2026Getting Started With Bug Bounties: 2026 Guide - Coursera beginnerGuide to bug bounty programs, this Coursera resource details how ethical hacking and vulnerability disclosure benefit organizations by identifying weaknesses through initiatives like Hack the Pentagon. It explains bug bounty mechanics, including scope, CVSS scoring for reports, and the varying payouts offered by major companies like Apple, Google, Microsoft, and Intel. The guide also suggests learning resources such as Hacksplaining, BugBountyHunter, and Google's Bug Hunter University, alongside essential technical skills like networking, operating systems, web technologies, and programming.
2026-04-10 2026A Beginner's Guide to Bug Bounties beginnerA Beginner's Guide to Bug Bounties
2026-04-10 2026Bug Bounty Hunting Methodology 2025 - Phirojshah beginnerBug Bounty Hunting Methodology 2025 - Phirojshah
2026-04-10 2026Bug Bounty 101: Complete Roadmap for Beginners (2026) beginnerRoadmap for beginners entering bug bounty hunting in 2026, this guide emphasizes foundational knowledge in networking, web applications, and cybersecurity concepts. It advocates for a focused approach to target selection, recommending less popular programs or Vulnerability Disclosure Programs (VDPs) over highly competitive ones. The entry details effective reconnaissance methodologies, highlighting the use of tools like Netlas for asset discovery and subdomain enumeration, combined with passive techniques and visual recon with Aquatone to identify potential attack surfaces.
2026-04-10 2026Bug Bounty Methodology Version 2025 beginnerBug Bounty Methodology Version 2025
2026-04-10 202631 Bite-Sized Tips and Bug Bounty Resources for 2026 beginnerLibrary of 31 bite-sized bug bounty tips and techniques for 2026, covering methods like hunting for blind XSS with match and replace rules, fuzzing virtual hosts with FFUF, finding related assets via favicon hash enumeration, identifying hosts with certificate issues, and leveraging copyright notices for reconnaissance. It also details techniques for DOM-based XSS, CSP bypasses, SSRF, bypassing file upload restrictions with Magic Bytes, currency confusion attacks, race conditions, JWT and XXE vulnerabilities, NoSQLi exploitation, Log4Shell hunting, CSRF bug scoring, GraphQL CSRF exploitation, and CORS exploitation via whitelisted third-party origins. → intigriti.com
2026-04-06 2026shuvonsec/claude-bug-bounty: AI Bug Bounty Framework intermediateFramework that transforms Claude Code into an AI bug bounty hunting partner, automating target reconnaissance, vulnerability scanning and validation, and professional report generation. It remembers past findings for improved efficiency, offers an autonomous hunting mode, and integrates with platforms like HackerOne and Bugcrowd. The framework includes specialized agents for various tasks and supports scanning for both Web2 and Web3 vulnerabilities, as well as GitHub Actions security.
2026-04-06 2026Disclosed: $4.3m Paid in HackerOne LHEs, PortSwigger Top 10 Released newsWriteup detailing Shazzer's debug-fuzz mode for iterating on payload templates and edge cases, and VulnLLM-R-7B, a code-oriented model for vulnerability identification. It also includes a Bugcrowd announcement about Chime paying double for P1 reports, and Vercel's open-source bug bounty program on HackerOne. The entry further notes Bugcrowd's hiring of Kuzushi as VP of Offensive AI and mentions Shannon, an autonomous web "hacker" agent.

Frequently Asked Questions

How do I get started in bug bounty?
Start by learning common vulnerability classes (XSS, IDOR, SSRF) through platforms like PortSwigger Web Security Academy and HackTheBox. Create accounts on HackerOne and Bugcrowd, begin with programs that have wide scopes and are beginner-friendly, and focus on thorough reconnaissance before testing. Reading disclosed reports is one of the fastest ways to learn what works.
How much can you earn from bug bounties?
Earnings vary widely. Low-severity bugs may pay $100-$500, medium $500-$5,000, high $5,000-$20,000, and critical findings $20,000-$100,000+. Top researchers earn six figures annually. Consistency and skill matter more than volume — one well-researched critical finding outweighs dozens of low-severity reports.
What makes a good bug bounty report?
A good report includes a clear title, step-by-step reproduction instructions, the security impact explained in business terms, proof of concept (screenshots, HTTP requests, or video), affected endpoints, and suggested remediation. Reports should be concise, professional, and demonstrate that the vulnerability was not pushed beyond what was necessary to prove impact.

Weekly AppSec Digest

Get new resources delivered every Monday.