Bug bounty & security testing marketplacePublic · Private · VDP programs

Break it before they do.

Zerohunt is where serious researchers hunt real targets and companies run public, private and VDP programs. Clear scope, honest triage, fair bounties by severity — and reputation you carry everywhere.

triage.streamLive
  1. CRITRCE in image-processing workervalid · $12,000
  2. HIGHSSRF via webhook URL validatorvalid · $3,000
  3. MEDIDOR on /invoices/:id/exporttriaged
  4. HIGHstored XSS in dashboard commentsvalid · $3,000
  5. CRITauth bypass on /api/v2/token/refreshvalid · $8,000
CRIT 30%HIGH 30%MED 20%LOW 20%Sample events
Browse live programsSee pricing
  • $1.2M+ Bounties paid
  • 2,400+ Valid findings
  • 1.8d Avg. first response
  • Program types: Public · Private · VDP
  • Triage: Managed or self-serve
  • Reputation: Two-sided & verified
  • Researchers: A learn-to-earn path

Trusted by security teams at

  • Equitas Small Finance Bank
  • OLA
  • CRED
  • Costco
  • Cholamandalam
  • Samsung
  • Burger King
  • Flipkart

01How it works

One loop, from scope to payout.

  1. Company

    Publish a program

    Companies define scope, rules, eligibility and a severity-to-bounty table, then publish public, private or VDP programs.

    OutputScope + severity table

  2. Researcher

    Discover & test

    Researchers find programs, read the scope, and test only authorized targets under a clear responsible-testing policy.

    OutputAuthorized test window

  3. Triage

    Report & triage

    Structured, evidence-backed reports enter a validation queue: valid, invalid, duplicate or needs-info, with a full discussion thread.

    OutputValidated finding

  4. Company → Researcher

    Reward & resolve

    Companies set severity and bounty, fix, and request a retest. Researchers earn and build verified, portable reputation.

    OutputBounty paid + retest

A finding's lifecycle

  1. Submitted
  2. Triage
  3. Needs info
  4. Valid
  5. Severity
  6. Bounty
  7. Remediation
  8. Retest
  9. Resolved

02Portals

Every role gets its own console.

Five focused surfaces, one system of record. Each side sees exactly the workflow it needs — no more, no less.

  1. 01

    Security researchers

    Researcher portal

    Discover programs, submit reports, and track rewards, reputation and learning.

  2. 02

    Security teams

    Company portal

    Create programs, review reports, and manage researchers, remediation and bounties.

  3. 03

    Platform analysts

    Triage portal

    Validate findings, classify, and manage duplicates, severity, SLAs and communication.

  4. 04

    Operations

    Admin portal

    Operate users, programs, reports, payments, challenges, disputes and platform health.

  5. 05

    Public & researchers

    Public marketplace

    Program discovery, researcher profiles, rankings and selected public disclosures.

Explore the public marketplace

03For companies

A security program console, not a giant SOC.

Publish a program in minutes with authorization that is impossible to misunderstand, then manage every finding to closure from one clean review workflow — no spreadsheets, no shared inboxes.

  1. 01

    Unambiguous scope

    In-scope and out-of-scope assets and prohibited techniques, stated explicitly on every program — authorization is never left to guesswork.

  2. 02

    Managed triage

    Optional expert validation classifies findings and handles duplicates and severity before anything reaches your engineers.

  3. 03

    Remediation & SLAs

    Track owners, response and resolution times, and request a retest — all from a single report view.

  4. 04

    Program reputation

    Transparent signals — responsiveness, bounty fairness and scope clarity — attract stronger researchers to your program.

Set up a program
In minutes
Program types
Public / Private / VDP
Pay only for
Valid findings
More for companiesCreate a program

04For researchers

Find real work. Earn. Build a name.

Zerohunt is built as a growth engine for legitimate researchers — from your first lab to your first critical finding and every bounty after. Free to join, fair by design.

  1. 01

    Real, clear targets

    Search by company, technology and vulnerability type. Know exactly what is authorized before you send a single request.

  2. 02

    Structured reports

    A guided form for title, asset, type, steps, impact and evidence — simple for first-timers, ready for triage.

  3. 03

    Fair rewards

    Transparent severity and bounty decisions, visible payout status, and a two-sided rating that holds companies accountable too.

  4. 04

    Verified reputation

    Valid findings, severity mix, acceptance rate and skill badges build a profile you carry across every program.

Joining & reporting
Always free
Every decision
Explained & appealable
Your reputation
Portable across programs
More for researchersBrowse programs
05The report, structured

Simple for first-timers. Ready for triage.

One guided form captures everything a triager needs to make a fair, fast decision — no back-and-forth guessing.

new report · northwind

Title

A clear one-line summary of the vulnerability.

Example: Auth bypass on /api/v2/token/refresh

Affected asset

The exact in-scope target or endpoint.

Example: api.northwind.example/v2/token/refresh in scope

Vulnerability type

IDOR, XSS, SSRF, auth bypass and more.

Example: Broken authentication

Steps to reproduce

Clear, repeatable steps a triager can follow.

Example: 1. Sign in as tenant A; capture its refresh_token.2. POST it to /v2/token/refresh with tenant B’s id.3. A valid session for tenant B is issued.

Impact

Why the issue matters, in real terms.

Example: Full account takeover without user interaction.

Evidence

Screenshots, requests, responses, video or PoC.

Example: request.harpoc.mp4screenshot.png

Researcher severity

An optional severity recommendation.

Example: LowMediumHighCritical

AI — assist, optional. Helps structure and suggest a category — never invents proof or decides.

06Learn & labs

A path from learning to real bounty participation.

Hands-on labs and challenges build verified skills, then move researchers into live programs where those skills earn real rewards.

Open the Academy
  1. Learn
  2. Practice
  3. Solve
  4. Earn badge
  5. Join bounty
07Hall of Fame

Ranked on quality, not volume.

Live standings · all time

Reputation is earned only on valid findings and weighted by severity, so the board rewards the bugs that matter.

  1. Rank 1: @r00tcause

    API & GraphQL
    Valid
    183
    Critical
    27
    Rep
    9,801
    Bounties earned$248,900

  2. Rank 2: @nullbyte

    Authentication & sessions
    Valid
    161
    Critical
    22
    Rep
    8,860
    Bounties earned$212,400

  3. Rank 3: @shibateam

    Mobile — Android
    Valid
    143
    Critical
    19
    Rep
    8,180
    Bounties earned$190,050

  1. Rank 4: @parseltongue

    Cloud & infrastructure    128 valid · 15 critical · 7,855 rep$164,300

  2. Rank 5: @ghostpackets

    Network & protocols    119 valid · 12 critical · 7,100 rep$148,700
Every rank, every periodView the full Hall of Fame
08Trust & safety

A marketplace that moves money runs on trust.

Six guarantees that hold on every program — for the company publishing it and the researcher testing it.

  1. Explicit authorization

    Every program states scope and prohibited activity. Authorization is never silently changed.

  2. Verified accounts

    Researcher and organization verification appropriate to risk, with KYC before real payouts.

  3. Full audit trail

    Every important decision is traceable, with an immutable report timeline.

  4. Secure evidence

    Proof and attachments are stored securely and shared only with the right parties.

  5. Anti-abuse controls

    Spam, duplicate and fabricated-evidence controls keep the signal high.

  6. Appeals & disputes

    A clear dispute workflow for both sides when a decision is contested.

09FAQ

Questions, answered.

Still deciding? Each side has its own page.

For companies For researchers

What is a bug bounty program?

A program is a company's invitation for researchers to test defined targets under clear rules, and to be rewarded for valid vulnerabilities based on severity.

Do I need to pay to submit reports as a researcher?

No. Researchers join for free, discover programs, and earn bounties on valid findings. Companies pay to run programs and, optionally, for managed triage.

What happens after I submit a report?

It enters triage, where it is validated as valid, invalid, duplicate or needs-info. Valid findings receive a severity and bounty decision, then move through remediation and retest to resolved.

Is my testing authorized?

Only within a program's stated scope and rules. Zerohunt makes in-scope and out-of-scope targets and prohibited techniques explicit, and authorization is never silently changed.

Does AI make the final decision on my report?

No. AI is kept small and supportive — it can help structure a report and suggest a category. It never invents proof or makes the final validity or severity decision.

Zerohunt · two doors, one workflow

One trusted workflow, from scope to payout.

For companiesStart a programSet up in minutes. Pay only for valid findings.For researchersHunt for bountiesJoining and reporting are always free.
New here? Create a free account See pricing