v3.4 · 12,419 hunters online

Find the bugs.
Earn the bounty.
Build the secure web.

HuntBug is the crowdsourced bug bounty platform for teams that ship fast. Run a public or private program, triage with confidence, and pay researchers the day a fix lands in production.

Start hunting →List your program
● 99.98% triage SLASOC 2 Type IIPayouts in 1099 / W8
~/huntbug/feed · live
submissionspayoutsscope
—:—:—crit@sahil_r → lumen-bank · Chained SSRF → RCE in /v3/payments/refund$42,000
—:—:—high@p4lerider → parallax · Auth bypass via stale JWT on /me/sessions$7,500
—:—:—med@nyx_0xff → orbital · IDOR on /invoices/{id} leaks customer PII$2,400
—:—:—high@k.tanaka → northwind · Stored XSS in shared workspace title field$5,000
—:—:—low@routesix → hexpath · Open redirect on /go?u=… (CSRF chained)$600
—:—:—crit@vexline → quanto-hlth · PHI exposure in radiology report endpoint$28,000
—:—:—med@m_eaves → stelvio · Rate-limit bypass on password reset$1,800
—:—:—high@dr_glitch → parallax · SQLi (blind) in admin search · err.code=42$8,200
streaming · 24 events/min↳ press / to filter
Securing payloads at
◆Northwind
▲Parallax
◈Lumen Bank
⬡Hexpath
○Orbital
▣Quanto Health
✦Stelvio
01 · Two sides, one platform

Built for the people finding bugs, and the teams that have to fix them.

Researchers ship reports. Companies ship patches. Everyone gets paid on time. HuntBug is the connective tissue.
For researchers

Hunt full-time, part-time, or whenever a bug ruins your weekend.

One dashboard for every program you watch. Real-time scope diffs, duplicate detection before you submit, and payouts the same week your fix lands.

  • + Personal reputation that follows you across every program
  • + Daily quests & certifications that unlock private invites
  • + Submission templates, scope sync, and a CLI for serial hunters
  • + Payouts via wire, Wise, USDC — choose at withdrawal
Create a hunter account →
For companies

Triage like an SRE on-call rotation, pay like a payroll system.

Open a public program in an hour or run a private one behind invite-only access. We'll handle the noise, the dedup, and the W8s — your team only sees real, reproducible bugs.

  • + Scope manager with live asset sync from your DNS & cert logs
  • + Duplicate checker — kills ~38% of reports before they hit your inbox
  • + SLA-tracked triage queue with severity-weighted alerts
  • + Escrow payouts, 1099 / W8 handling, line-item invoicing
List your program →
Bounties paid · 2026$1.2M+ 31% YoY
Bugs resolved6,704avg. triage 6h 12m
Active hunters2,914+ 204 this week
Live programs347112 public · 235 private
02 · The hunt loop

From "I think I found something" to a wire transfer in four steps.

No back-and-forth on Twitter DMs. No 90-day silence after submission. The whole loop happens in HuntBug, on a clock you can see.
01
DISCOVER

Pick a program in scope

Browse 300+ live programs. Filter by stack, bounty range, response time, or known dupes.

02
SUBMIT

File a single report

Markdown editor with payload templates, video capture, and dedup hash. We pre-screen before triage sees it.

03
TRIAGE

SLA-clocked review

Triagers and the program team work the same thread. Severity is locked at acceptance; no scope-creep haggling.

04
PAY

Get paid the week of the fix

Escrow releases automatically when the patch ships. Tax forms, multi-currency, all handled.

03 · Open directory

347 live programs. Six figures of bounties on the table right now.

Browse the full directory →
Sample below. Sorted by max bounty.
Program
Scope
Bounty range
Triage SLA
LB
Lumen Bank
API · web · mobile
▢ 124 assets
$500 – $50,000
< 6h triage
view →
Px
Parallax
Web · infra
▢ 68 assets
$300 – $25,000
< 8h triage
view →
Qh
Quanto Health
API · mobile · IoT
▢ 42 assets
$750 – $35,000
< 4h triage
view →
Nw
Northwind Air
Web · API
▢ 31 assets
$250 – $18,000
< 12h triage
view →
Or
Orbital Compute
Infra · CLI · API
▢ 53 assets
$400 – $22,000
paused · queue full
view →
St
Stelvio Pay
API · web
▢ 19 assets
$300 – $15,000
< 10h triage
view →
04 · Community

A community measured in CVEs, not vanity metrics.

Public reputation, certifications, and daily quests. The grind is real, but so is the leaderboard.

Top hunters — all time

All-timeQ2 2026Last 30d
01
SR@sahil_rResearcher · IN
28,210 RP$21,400
02
P4@p4leriderResearcher · DE
24,108 RP$18,500
03
VX@vexlineResearcher · BR
23,640 RP$16,800
04
KT@k.tanakaResearcher · JP
19,110 RP$14,200
05
NX@nyx_0xffResearcher · US
18,040 RP$12,900
06
DG@dr_glitchResearcher · UK
17,930 RP$18,400
Daily quest · public
Find an IDOR in any open program before 23:59 UTC.
DAY 47
STREAK

Insecure Direct Object References hide in plain sight. Today's hint: look for sequential IDs in API responses.

+ 250 RP · +$50 bonus1,841 hunters · 3 winners so far
Hall of fame · this month
3 hunters cleared $25k+ in June.

Sahil R. found a chained SSRF→RCE in a payment processor. $12,000 paid out, 6-day triage.

Get started

Pick a side.
Both pay.

Start hunting →List your program