Reading a bounty scope

Start with the permitted target

A bounty scope identifies the websites, apps, repositories or contracts that a programme accepts for testing. Match the exact hostname, repository version or contract address, then read the permitted methods and excluded findings. Previously known issues, duplicate reports and findings below the programme’s impact threshold can affect reward eligibility. HackerOne’s Code of Conduct requires researchers to follow each programme’s own policy.

The bounty economics tracker contains 1,143 public programmes in its 28 October 2026 snapshot: 449 on HackerOne, 297 on Bugcrowd, 144 on Intigriti, 56 on YesWeHack, one in the Federacy feed, 148 live programmes on Immunefi and 48 public programmes on Cantina. The Federacy entry retains its 8 October observation because its feed was unavailable in the later refresh. Feed coverage changes over time. Open the programme’s current page before testing.

Read the written scope alongside the asset list

Written instructions can define targets more fully than the structured asset list. On 28 October, 13 of 48 live Cantina programmes supplied scope in prose without structured asset groups. Asset counts therefore measure listed entries; a single entry can cover several systems. The platform data comes from the public directory mirror, Immunefi and Cantina.

For a contract programme, read the eligible impacts as well as the addresses. Check the proof-of-concept requirements, funds-at-risk calculation, identity checks and any rules governing local forks or production testing.

Check the protection the operator offers

Safe harbour sets out an operator’s commitments towards research conducted under its policy. The disclose.io template addresses authorisation, anti-circumvention restrictions, the operator’s terms of service and good-faith conduct. Read the adopted wording and its conditions; the operator’s commitment has a defined scope.

Bugcrowd’s directory field records 222 full, 51 partial and 24 other or unstated safe-harbour entries among 297 programmes on 28 October. The programme’s actual policy is the place to resolve an unclear permission before testing.

Keep a person responsible for AI-assisted findings

HackerOne permits responsible AI assistance, requires human validation of hackbot findings and makes the researcher accountable for every submission. A report needs reproducible steps and demonstrated impact. Automation must also follow the target’s rate limits, testing restrictions and disclosure rules.

Use the AI-policy comparison to find the relevant written policy. Check whether it requires disclosure of the tools used, how a proof must be supplied and who may receive vulnerability details. Platform rules and the individual programme’s conditions apply together.

Treat response times as historical measurements

The 28 October snapshot contains the following medians of HackerOne programmes’ reported statistics. Each measure has its own reporting sample.

An award, a payment and a resolved report are separate events. Use these figures to compare programmes’ past handling times, and budget for the uncertainty of the individual report.

Compare maximum rewards within each currency

An advertised ceiling is the maximum available under the programme’s conditions. The actual award depends on the accepted impact, severity, eligibility and reward rules.

On Immunefi, 127 of 639 reward rows use a funds-at-risk percentage capped at up to 10%. Cantina’s reward pots have their own payout conditions and currencies. Keep those rules beside the headline amount when comparing opportunities. The tracker links each programme so you can check the current terms.

Maintainers can request AI-generated vulnerability reports

Anthropic opened its opt-in OSS Scanner on 8 October 2026. It sends model-generated vulnerability reports to open-source maintainers who request the service. Those reports arrive without human validation, so maintainers still need to reproduce the finding and assess its impact. Participation in that service has its own access and disclosure process; an accepted bounty depends on the target programme’s rules.