Coordinated Vulnerability Disclosure
Find the flaw.
Report it. Get paid.
BountiesAlert connects security researchers with organizations that want their vulnerabilities found responsibly. Published scope, defined rewards, and safe harbor on every program.
From discovery to reward in four steps
No paperwork, no account, no friction. Just a clear path from finding to payout.
Pick a program
Browse active programs. Every program publishes its scope, rules, and reward range up front — no guesswork.
Find & document
Test in scope, then write a clear report: affected asset, reproduction steps, and real-world impact.
Submit securely
Send your report through the program form. No account required — just your email for follow-up.
Get triaged & rewarded
Our team validates, communicates status, and pays out based on the published severity tiers.
What researchers hunt for
Programs reward findings across the full severity spectrum. Here is what typically lands the highest bounties.
Remote Code Execution
Arbitrary command or code execution on a target system.
SQL & NoSQL Injection
Injection flaws that expose or corrupt backend data stores.
Broken Access Control
IDOR, privilege escalation, and missing authorization checks.
Authentication Bypass
Logic flaws that defeat login, MFA, or session handling.
Server-Side Request Forgery
Coercing the server into making unintended requests.
Cross-Site Scripting
Stored, reflected, and DOM-based script injection.
Cross-Site Request Forgery
Forcing authenticated users into unintended actions.
Information Disclosure
Leaked secrets, stack traces, or sensitive metadata.
Built on researcher trust
The things that make a disclosure program worth your time — guaranteed up front.
Safe harbor
Good-faith research conducted within scope will not be met with legal action. Test with confidence.
Transparent scope
Every program lists exactly what is in and out of scope, so you always know what is fair game before you test.
Defined response times
Each program commits to a response window. You always know when to expect an update.
Tiered rewards
Bounties map to severity. Critical findings earn the most, and the bands are published in advance.
Active programs
Pick a target and start hunting.
From the blog
Guidance on writing better reports and disclosing responsibly.
The anatomy of a great vulnerability report
A clear report gets triaged faster and paid sooner. Here is the structure our team rewards.
DisclosureScope is a contract, not a suggestion
Why staying in scope protects both researchers and programs — and how BountiesAlert keeps scope honest.
DisclosureCoordinated disclosure, explained
What "responsible" actually means, and the timeline that keeps everyone safe.
Ready to start hunting?
Every program publishes its scope, rules, and rewards. No account needed — just find, report, and get paid.