Bounties

An escrow on top of the mission, not instead of it.

A bounty is optional extra pay, reserved up front, for testers who find something real. It sits on top of ordinary compensation — base mission payment for valid in-scope work, finding bonuses by accepted severity, specialist premiums, retest payment paid independent of pass or fail. The bounty changes who gets the extra, never whether valid work gets paid.

Four ways to run one.

First qualifying findingThe first tester to report a valid, in-scope, severity-eligible bug earns the bounty. If nobody finds one, base mission pay still covers valid work performed.

Severity poolThe bounty splits across every qualifying finding at or above the threshold, weighted by severity. Fewer qualifying findings raise each share; more shrink it.

Base + bounty — the defaultEvery tester earns base mission pay regardless of outcome, and the bounty adds on top for severity-eligible findings. Nobody works for free on the chance of a bounty.

Clean-run challengeBase pay is paid whether or not a bug is found. A clean run gets you a scope statement of what was tested and by whom — never a badge claiming the product is bug-free.

Open bounties.

Open one →

No public bounties are open right now.

Founders: open one. Testers: apply — invites and matched missions don't appear here.

What a bounty is never for

Never a licence to attack.

A bounty is not an invitation to test for security vulnerabilities outside the stated scope. Penetration testing, exploitation attempts, credential attacks, infrastructure probing, and any testing outside the exact scope and environments the bounty states are excluded — unconditionally, even if a real weakness is found. Report it through the disclosed scope, or not at all.

Every bounty states, before it opens.

Exact scopeWhich surfaces, flows and environments are in play, and which are excluded.
EnvironmentsThe devices, OS versions, browsers and locales in scope.
Severity thresholdThe minimum severity that qualifies for payout.
Time windowThe exact start and end of the bounty period.
Duplicate and known-issue policyHow repeat and already-known findings are handled.
Minimum evidenceWhat a finding must include to be considered.
Signal eligibilityWhether Product Signals can qualify, or only verified bugs.
Verifier independenceThe verifier confirming a finding is never the tester who reported it.
Dispute pathHow a rejected or downgraded finding gets reviewed.
Maximum payoutThe escrow ceiling for the bounty, reserved up front.
Tie-break ruleHow simultaneous or near-simultaneous qualifying findings are resolved.

Escrow, not a promise

Reserved the moment it opens.

The maximum payout leaves your balance the moment the bounty opens, the same way a mission's base cost is reserved. Bounty exposure is one of the seven factors in every quote — see how pricing works.

Open a bounty Read the FAQ