Frequently asked questions

We aggregate programs from major platforms including HackerOneBugCrowdIntigritiImmunefiHackenProofYesWeHackStandoff365BI.ZONECode4renaSherlockCodeHawksCantinaBugbaseBugRapIssueHuntInspectivBug Bounty SwitzerlandAuditOneCertiKHuntrRemedyCompass SecurityGObugfreePatchDay We keep expanding as new platforms emerge.

Listings are refreshed frequently throughout the day. New public programs usually appear on BBRadar.io within minutes of being published on the source platform.

BBRadar is a tracker, not a submission platform. Open each program and submit your report directly on the program’s platform page. We link to the official program URL for every listing.

Use tags and filters: try the mobile tag for mobile targets, or the smart contract tag for web3. You can also use the search bar to filter by keywords.

BBRadar.io focuses on publicly available programs. Private or invite‑only programs are not listed.

Yes. Use the “Sort by” control above the listings to sort by date (newest/oldest), name (A–Z/Z–A), and by maximum or minimum bounty. Pro users can also sort by report count or submission cost. Programs without a detected submission cost are currently treated as free.

Yes, with Pro. When a platform publishes this data, bbradar shows the program’s submission fee or deposit in program listings, program details, Latest Targets, and Pro API responses. The Free submission fee only toggle works together with the other listing and Latest Targets filters. Money is displayed with a $ prefix, while non-cash systems such as YesWeHack are shown in credits. If no submission cost is detected, the program is currently shown as Free. Only positive costs are added to program, lifecycle, and target-change notifications.

We poll and refresh throughout the day. When new public programs go live on their platforms, they typically appear on BBRadar.io within minutes.

The Self-Hosted Pro catalog makes security programs run directly by organizations easy to find alongside the main platform catalog. It brings each program’s rewards, scope, policy, and reporting route into one profile, shows paid bounties first, and lets you include VDPs when you want broader disclosure coverage. Always review the linked official policy before testing.

Latest Targets helps you follow confirmed scope additions, re-additions, updates, and removals. The Commits tab shows supported repository branch updates connected to bounty targets. Use these feeds to spot activity, then open the linked official scope or repository provider before acting.

They are Pro research signals that help you compare programs and targets. Program opportunity tiers highlight promising listings, while each target can include a score, label, factor breakdown, and dupe-risk context. Use them to prioritize research, not as a guarantee of payout, exploitability, or a duplicate-free report.

No. The Pro API and MCP server cover supported platform programs, opportunity data, target intelligence, and target changes. The Self-Hosted catalog and repository-change feed are currently available through the bbradar website and supported notifications, but not through the API or MCP package.

Go to Account & Billing to create, regenerate, or delete your API key. Then open Pro API Docs for endpoint details and cURL examples.

Yes. Pro users can manage notification rules for platform program, Self-Hosted paid/VDP, target, and repository-change streams plus program opportunity tiers, target scores and labels, dupe risk, platforms, scope tags, languages, bounty ranges, free or paid submission fees with an optional maximum, target changes, and specific programs or targets.

Notifications can be delivered to your private Telegram DM and the Pro Discord channels after you connect your account. You can also browse Latest Targets and Commits on the site.

Subscribe to Pro, then use Account & Billing to connect Telegram for private DM alerts and connect Discord for server channel access. Then open Notification Rules to choose which alerts you want.

No. Telegram delivery is limited to private 1:1 DMs connected from the Pro user account, so alerts stay personal and tied to active Pro access.

Monthly and yearly Pro plans include the same current features. Stripe handles checkout, invoices, payment methods, and cancellation. If you cancel, Pro normally remains available until the end of the period you already paid for; use Account & Billing to manage the subscription and confirm its current status.

Use the “Get Listed” page to contact us. We welcome requests from platforms and maintainers of public programs.

No. We are an independent aggregator. Each program remains owned and managed by its respective platform or organization.