Bug Bounty Platforms Compared: Where to Start
There are a lot of bug bounty and crowdsourced-security platforms, and a list of logos tells you nothing about where to begin or what you are signing up to. This page sorts the ones worth knowing into tiers — where to start, where to go once you are vetted, and which to approach carefully — with one honest line about each. It is a map, not a leaderboard.
Before any of it, the rule that matters more than the whole table below.
The one rule
Never test a system because it appears on a list — this one included. These platforms run live programs against real companies’ production systems. Testing is legal only inside a program’s published scope, following its rules. A platform account is permission to read programs and submit reports; it is not permission to attack anything you like. If you are not certain an exact asset is in scope, it is out. The place to practise freely is your own machine — the local Juice Shop lab cannot say no.
Nyx read “crowdsourced security” and heard “attack whoever I want, I’m the crowd now”. That is not what it means. The crowd is invited into specific rooms. Walk into a room nobody invited you to and it stops being research. — Nyx
The platforms, by tier
“Start here” means open sign-up, public programs you can read today, and good documentation. “Later” means you apply and pass checks first. “Careful” means read twice before you rely on it. Facts below are the things we are reasonably sure of; anything marked verify you should confirm on the platform’s own site before trusting it.
| Platform | Tier | Good to know |
|---|---|---|
| HackerOne | Start here | One of the largest platforms. Open sign-up, many public programs and VDPs. Its free training, Hacker101, includes a CTF whose points can earn private-program invites. |
| Bugcrowd | Start here | Large platform, open sign-up, public and private programs. Bugcrowd University is free and a solid structured starting point. |
| Intigriti | Start here | Europe-based, open sign-up, growing program list. Runs a well-known monthly XSS challenge that is good, legal practice. |
| YesWeHack | Start here | Europe-based (France), open sign-up, strong in Europe and Asia. Its free Dojo gives you training exercises. |
| Synack Red Team | Later / vetted | You apply and pass a skills assessment to join. Closer to paid, managed pentest work than open hunting. Not a first stop. |
| Cobalt | Later / vetted | Pentest-as-a-service with a vetted pool of testers (the “Core”). Application and skills checks apply. Again, structured paid work rather than open bounties. |
| Detectify Crowdsource | Different model | You submit vulnerability research and modules that feed Detectify’s scanner, rather than hunting named targets. Invite-based. Worth knowing it is not classic hunting. |
| HackenProof | Different model | Heavily web3 and crypto programs. Useful if that is your interest; less so if it is not. Verify current program mix before you commit time. |
| Open Bug Bounty | Careful | A coordinated-disclosure site that lists issues on sites which often have no program and never invited testing. Payment is not guaranteed, and “it was on Open Bug Bounty” is not authorisation. Treat with caution. |
| Zerocopter, FireBounty, AntiHACK, Cyber Army ID, Vulnerability Lab, RedStorm, SafeHats, BugBounty.jp, Yogosha | Verify first | Verify before relying on any of these — may be invite-only, regional, aggregators rather than platforms, or inactive. Check the platform’s own site is live and running real programs before investing time. |
How to read the tiers. Start-here platforms are where you learn to read scopes, write reports and submit your first finding. Vetted platforms are a destination once you have skills to prove. The rest are context — know they exist, understand their model, and do not let a big list push you toward signing up for everything at once.
Train first, then hunt
Almost nobody’s first move should be opening a program and firing. The skills — web app testing and clear report writing — are the whole job, and they are far cheaper to build on a target that cannot press charges. A sensible order, cheapest first:
- PortSwigger Web Security Academy — free, the standard web-hacking course, built around Burp Suite Community. Start here.
- Hacker101 + CTF — free videos and a capture-the-flag; points can unlock private HackerOne invites.
- Bugcrowd University — free, structured, a good second pass over the same ground from a different angle.
- Monthly challenges — YesWeHack’s Dojo and Intigriti’s monthly XSS keep you practising on something legal and fresh.
- Local labs — OWASP Juice Shop, DVWA, and crAPI for APIs, all bound to 127.0.0.1. Set them up with the Docker security lab.
- Then paid and structured — the Hack The Box Academy “Bug Bounty Hunter” path and the HTB CWES certification (affiliate link) when you want a graded, employer-recognised route. StashGrid earns a commission on that link at no cost to you — see our affiliate disclosure. HTB is moving its older CBBH certification to CWES, so check the current name on their site.
The HTB link is how Steven keeps the lights on, and he will tell you himself. It is also a genuinely good path — I checked. The free rungs above it are not filler, though. Skip them and you will pay for a certification to teach you what the Academy gave away. — Nyx
Can you actually make money from this?
Honestly: most people earn very little, especially at the start. Bug bounty income is heavily skewed — a small number of full-time hunters earn a lot, a long tail earns pocket money or nothing, and the first valid bug on a real program often takes months of unpaid practice to reach. Treat early payouts as a bonus, not a salary, and do not quit anything on the strength of them.
The better reason to do this is that the skills transfer. Reading an app the way an attacker does, finding a real flaw, and writing it up so a stranger can reproduce and fix it — that is exactly what application-security, pentest and blue-team roles hire for. Plenty of people never earn much in bounties and still land the job the bounties trained them for. If the money arrives, good. If the career arrives, better.
Nyx was certain she would be rich by Friday. It is Friday. She is not rich. She is, however, annoyingly good at writing a reproduction step, which is the part that was always going to pay. — Nyx
Go deeper
- Attack OWASP Juice Shop with Docker — the local target to practise on, legally, forever.
- Awesome Bug Bounty Tools — a curated toolbox for once you know what you are reaching for.
- TryHackMe vs Hack The Box and TryHackMe — structured practice when you want a guided path.
- Start Here — the free StashGrid learning path from home lab to SOC, if bug bounty is one door among several you are weighing.
Original reference. Platform tiers follow Steven’s own research notes; the Hack The Box CBBH-to-CWES transition was confirmed on Hack The Box’s site on 14 October 2026. Platforms change their models, scopes and sign-up rules often — treat everything marked verify as a prompt to check the source before relying on it, and tell me if something here has drifted.