The Best Vulnerability Disclosure Programs (Less Competitive Bounties)

TL;DR- There’s a ton of programs for bug bounties and vulnerability disclosure, but they’re usually filled with competition because they’re so popular. Here are a few programs that minimize the competition and still provide great rewards.

Bug bounties are critical in the cybersecurity industry, and millions are paid out every year to the white-hat hackers who contribute. That being said, how can someone, especially a new bug hunter, find these bounties when there are hundreds of thousands of hackers competing to find similar ones? Finding a smaller VDP (vulnerability disclosure program) is a great solution, here’s a few of my favorites.

BugCrowd Community List →

This is hosted on BugCrowd which is a VDP itself, but it also provides a ton of great smaller programs on it’s page as well. It’s always up to date, and contains plenty of programs for smaller bug hunters to choose from and minimize the competition aspect.

It’s also got some helpful filters in order to view specific types of programs that you’d like to participate in. Filters like bug bounty eligible, Hall of Fame’s, and safe harbors will show you some of the best VDPs to get involved with at the moment.

Project Discovery Chaos →

This is a really interesting site that showcases some great programs and domains that aren’t usually shown on the bigger VDPs. They’re updated every few hours or so, and the list is fairly large. It’s easy to pick out specific kinds of programs, and I’m a big fan of this site because of it’s simplicity and functionality.

It’s got a bunch of links to help developers access different aspects of VDPs, and it even curates the recon data from DNS datasets for better insights.

FireBounty →

Lesser known but still very valid, FireBounty is a great site to learn about bug hunting and actually take part in VDPs. It’s a much bigger site than the others listed, and it follows more of a forum-looking app design. You can actually publish your own VDPs here as well, which is handy if you’re also a developer.

Tons of features, filters, and it’s fairly easy to use. Their web crawlers access VDPs on a list of other websites, and you can manually input your own. There’s roughly 15,000 users on this site, rather than the hundreds of thousands on something like HackerOne.

Bonus →

Here’s a list of some great google dorks for sites that may not have VDPs, but are vulnerable to some decent bounties. I suggest learning the syntax of Google a bit for the purpose of dorking, which is a valid hacking method.

Thanks for reading up on some great VDPs. I hope you found one that works for you, and if you found this post interesting feel free to give some claps. Check out The Gray Area for more computer science and cybersecurity related posts. If you’re not already a member and you’d like to access all my posts (and everyone else’s on Medium), sign up using my referral link →

Thanks!