Platform measurements on the YFarmX Bounty Economics tracker: what public bug bounty programmes pay, how fast they answer, and how many give full safe harbour, measured from the platforms' own data.https://yfarmx.com/en-GBhttps://yfarmx.com/tools/bounty-economics/cantina/https://yfarmx.com/tools/bounty-economics/cantina/Cantina's public feed holds 73 programmes, 51 of them live on 19 September 2026, with 467 in-scope assets across 137 asset groups. 14 of the 51 live programmes publish scope only as prose, so a pipeline reading structured fields sees nothing for them. The largest reward pot is Uniswap's at 15,500,000 USDC, then Reserve Protocol at 10,000,000 USDC. 38 live programmes require KYC and 46 are triaged by Cantina. Measured from the platform's own endpoint.Sat, 19 Sep 2026 00:00:00 GMTCantinaCONFIRMEDhttps://yfarmx.com/tools/bounty-economics/immunefi/https://yfarmx.com/tools/bounty-economics/immunefi/Immunefi's public feed holds 237 programmes, 170 of them live on 19 September 2026, with 5,843 in-scope assets (5,225 smart contracts, 354 blockchain or DLT, 264 web). The median advertised ceiling is $100,000 and the top is $15,000,000 at LayerZero, with $109,262,597 of combined ceiling across the live set. 97 of 170 live programmes require KYC and 158 publish a proof-of-concept matrix by asset type and severity. Measured from the platform's own endpoint.Sat, 19 Sep 2026 00:00:00 GMTImmunefiCONFIRMEDhttps://yfarmx.com/tools/bounty-economics/federacy/https://yfarmx.com/tools/bounty-economics/federacy/Federacy lists 35 public programmes in the mirror with 99 in-scope assets, 7 of them offering awards. Measured 11 September 2026 from the platform's own data as mirrored.Fri, 11 Sep 2026 00:00:00 GMTFederacyCONFIRMEDhttps://yfarmx.com/tools/bounty-economics/yeswehack/https://yfarmx.com/tools/bounty-economics/yeswehack/YesWeHack lists 58 public programmes in the mirror, 57 of them publishing a maximum bounty, with a median of 3,000 and a top of 230,000 at Swiss Post E-Voting. The feed carries no currency field, so each figure stands in the programme's own currency. Measured 11 September 2026 from the platform's own data as mirrored.Fri, 11 Sep 2026 00:00:00 GMTYesWeHackCONFIRMEDhttps://yfarmx.com/tools/bounty-economics/intigriti/https://yfarmx.com/tools/bounty-economics/intigriti/Intigriti lists 137 public programmes in the mirror, 69 of them publishing a maximum bounty, in three currencies: 50 in euros with a median of €2,500 and a €15,000 top, 18 in dollars with a median of $9,250 and a $100,000 top at Intel, and one in sterling at £12,500. Measured 11 September 2026 from the platform's own data as mirrored.Fri, 11 Sep 2026 00:00:00 GMTIntigritiCONFIRMEDhttps://yfarmx.com/tools/bounty-economics/hackerone/https://yfarmx.com/tools/bounty-economics/hackerone/HackerOne lists 449 public programmes in the mirror, all open to submissions, 223 of them paying a bounty and 325 managed by HackerOne staff, with 41,328 in-scope assets between them. The median programme answers a report in 9 hours (n 410), pays a bounty 222 hours after submission (n 212) and resolves the report at 1,174.5 hours, about 49 days (n 300). Measured 11 September 2026 from the platform's own data as mirrored.Fri, 11 Sep 2026 00:00:00 GMTHackerOneCONFIRMEDhttps://yfarmx.com/tools/bounty-economics/bugcrowd/https://yfarmx.com/tools/bounty-economics/bugcrowd/Bugcrowd lists 278 public programmes in the mirror, 273 of them publishing a maximum payout. The median ceiling is $4,000, the mean $18,598 and the top of the table $3,000,000 at OpenSea. 207 programmes give full safe harbour, 50 partial and 21 state none, so 71 of 278 give less than full. Measured 11 September 2026 from the platform's own data as mirrored.Fri, 11 Sep 2026 00:00:00 GMTBugcrowdCONFIRMED