OWASP Project • AGPLv3 Licensed

One landing page for public bugs, secure disclosures, and contributor momentum.

OWASP BLT gives teams a practical front door to collect issue reports, route sensitive vulnerabilities to BLT-Zero, and keep community reporting transparent through a live leaderboard.

Start reporting Use BLT-Zero

16
Bugs reported: 4
Domains: 5
Active reporters

What OWASP BLT gives your team

Built for practical bug intake: clear public reporting, safe vulnerability handling, and community visibility in one workflow.

Public bug reports

Capture 404/500 issues, UI regressions, performance problems, typo fixes, and policy violations in one place.

Anonymous intake via BLT-API

Contributors can submit reports without exposing account identity when privacy is important.

Secure vulnerability path

Route critical security disclosures through BLT-Zero with zero-log, zero-tracking guarantees.

Live leaderboard

Recognition stays visible through an auto-refreshed leaderboard generated from issue activity.

Report issues on any website

BLT covers the entire internet — report bugs, broken pages, or security problems on any domain, not just your own.

Earn rewards for every report

Reporters earn BACON tokens for accepted bug reports, turning community contributions into tangible recognition.

How teams use OWASP BLT daily

Keep public issue intake simple, keep sensitive security reports private, and keep contributor trust high with transparent tracking.

Report a public bug

GitHub template or anonymous submission

Supported issue categories include:

404 / 500 errors Functional issues Performance Slow loading Typos Design issues IP / trademark License violations

Report anonymously

Submit through BLT-API without exposing your GitHub identity.

Report a bug

Report a vulnerability

Private channel powered by BLT-Zero

For sensitive security findings, use a private disclosure route with stronger safety guarantees:

Zero logs Zero tracking Zero storage Encrypted transport

Only the report ID and status are visible to the organization. Sensitive vulnerability payloads are not stored in the receiving server.

Report vulnerability

Recent bug reports

Latest community-submitted issues from this repository

View all reports

[BUG] whole div "Chapters", should be clickable and remove test data

DonnieBLT1

Mar 8, 2026

Yes, this is a bug reported for http://www.owasp.community/ it will stay open until they fix it

5 comments

[BUG] video bugs are not showing up

DonnieBLT1 1

Mar 2, 2026

Issues aren't particularly assigned here as such. You can directly raise a PR if the copilot one is not in the ready to merge zone yet. If it is, then that'll probably get merged.

2 comments