Frequently asked questions

We aggregate programs from major platforms including HackerOneBugCrowdIntigritiImmunefiHackenProofYesWeHackStandoff365BI.ZONECode4renaSherlockCodeHawksCantinaBugbaseBugRapIssueHuntInspectivBug Bounty SwitzerlandAuditOneCertiKHuntrRemedyCompass SecurityGObugfreePatchDayHackZar We keep expanding as new platforms emerge.

HackZar coverage includes public program profiles, reward ranges or recognition-only VDP status, scope targets, and total report counts where available. Enable Include VDPs to see recognition-only programs. Pro users can inspect targets and report counts and select HackZar in Notification Rules. Catalog dates use the Created date published on each program page. When that date is unavailable, a conservative estimate is used.

We check listings throughout the day. Update times vary by platform and depend on source availability, rate limits, and successful verification. Incomplete checks preserve existing listings.

BBRadar is a tracker, not a submission platform. Open each program and submit your report directly on the program’s platform page. We link to the official program URL for every listing.

Use tags and filters: try the mobile tag for mobile targets, or the smart contract tag for web3. You can also use the search bar to filter by keywords.

BBRadar.io focuses on publicly available programs. Private or invite‑only programs are not listed.

Yes. Use the “Sort by” control above the listings to sort by date (newest/oldest), name (A–Z/Z–A), and by maximum or minimum bounty. Pro users can also sort by report count or submission cost. Programs without a detected submission cost are currently treated as free.

Yes, with Pro. When a platform publishes this data, bbradar shows the program’s submission fee or deposit in program listings, program details, Latest Targets, and Pro API responses. The Free submission fee only toggle works together with the other listing and Latest Targets filters. Money is displayed with a $ prefix, while non-cash systems such as YesWeHack are shown in credits. If no submission cost is detected, the program is currently shown as Free. Only positive costs are added to program, lifecycle, and target-change notifications.

We check sources throughout the day. A program appears after its source data has been retrieved, validated, and saved. Source outages, rate limits, and verification can delay publication.

The platform has confirmed that the program is paused. Its listing remains available for reference, with previously published rewards and scope. Current bounty eligibility and active opportunity signals are disabled while paused. Check the official policy before choosing work; retained targets do not establish current permission to test.

The Self-Hosted Pro catalog makes security programs run directly by organizations easy to find alongside the main platform catalog. It brings each program’s rewards, scope, policy, and reporting route into one profile, shows paid bounties first, and lets you include VDPs when you want broader disclosure coverage. Always review the linked official policy before testing.

Latest Targets helps you follow confirmed scope additions, re-additions, updates, and removals. The Commits tab shows supported repository branch updates connected to bounty targets. Use these feeds to spot activity, then open the linked official scope or repository provider before acting.

They are Pro research signals that help you compare programs and targets. Program opportunity tiers highlight promising listings, while each target can include a score, label, factor breakdown, and dupe-risk context. Use them to prioritize research, not as a guarantee of payout, exploitability, or a duplicate-free report.

No. The Pro API covers platform and Self-Hosted program profiles, active target inventories, platform opportunity data, target intelligence, platform target changes, and minimal platform repository-change events. Self-Hosted responses explicitly mark unavailable signals instead of inventing opportunity scores, report counts, target-change history, submission costs, or repository changes. Repository events are available through the website, read-only Pro API, and supported notifications; MCP 0.2.3 also exposes get_repository_changes with compact program summaries and incremental polling. Snapshot parameters and some newer provenance fields remain HTTP API capabilities.

Go to Account & Billing to create, regenerate, or delete your API key. Then open Pro API reference for endpoint details and cURL examples.

Yes. Pro users can manage notification rules for platform program, Self-Hosted paid/VDP, target, and repository-change streams plus program opportunity tiers, target scores and labels, dupe risk, platforms, scope tags, languages, bounty ranges, free or paid submission fees with an optional maximum, target changes, and specific programs or targets.

Notifications can be delivered to your private Telegram DM and the Pro Discord channels after you connect your account. You can also browse Latest Targets and Commits on the site.

Subscribe to Pro, then use Account & Billing to connect Telegram for private DM alerts and connect Discord for server channel access. Then open Notification Rules to choose which alerts you want.

No. Telegram delivery is limited to private 1:1 DMs connected from the Pro user account, so alerts stay personal and tied to active Pro access.

Monthly and yearly Pro plans include the same current features. Stripe handles checkout, invoices, payment methods, and cancellation. If you cancel, Pro normally remains available until the end of the period you already paid for; use Account & Billing to manage the subscription and confirm its current status.

Email [email protected] for private account or billing questions. Include the page URL, approximate time, and visible status. Keep credentials, connection links, payment details, and session cookies out of the message. The troubleshooting guide lists useful support context.

Use the “Get Listed” page to contact us. We welcome requests from platforms and maintainers of public programs.

No. We are an independent aggregator. Each program remains owned and managed by its respective platform or organization.