Table of contents
25
By Salman Khan, OSCP+, Founder of XHack, SRT (Synack Red Team member)
Read this in 30 seconds: Most hunters pick a bug bounty program by its top payout and its brand name, then find out weeks later that it is slow, picked over, or closed to them. The program page already shows you most of that before you send a single request.
- HackerOne’s own program pays most of its reports at the low end. Its rewards summary on October 24, 2026, shows 49.23% of resolved reports were Low severity at an average of $173. Critical was 2.71%.
- A badge is a promise but the average is the record. The same page carries a “Fast Payment” badge (paid within one month of the report) and an average time from submission to bounty of 1 month, 1 week.
- HackerOne’s March 2026 maturity framework gives you a yardstick. At the baseline level, a human replies within 3 business days and payment arrives within 14 days. An automated reply does not count.
- Some programs are locked to new accounts. HackerOne gives hunters below a program’s Signal requirement 3 trial reports, then a 90-day pause. Node.js has required a Signal of 1.0 since early 2026.
- The rules can rule out your tools. Intigriti’s own program caps automated tooling at 10 requests per second, and YesWeHack’s asks hunters to refrain from automated tools.
Choosing a bug bounty program is the first decision in every hunt, and most guides treat it as a matter of taste. It is closer to reading a small balance sheet. Each of the four big platforms prints a track record on the program page: how fast the team replies, what it actually pays, how busy the program is, and what it allows.
I read the program pages HackerOne, Bugcrowd, Intigriti and YesWeHack run for their own platforms on October 24, 2026, plus the documentation behind each number. This guide shows what each figure means, which ones flatter, and how to score a bug bounty program in ten minutes before you spend a weekend on it.
The page that lists the scope also lists how the program has behaved, so you can judge the team before you judge the target. Here is what each platform showed on its own program page on October 24, 2026:
| Platform (its own program) | Response figures shown | Payout figures shown | Activity and scope signals |
|---|---|---|---|
| HackerOne | 5 hours to first response, 7 hours to triage, 1 month 1 week to bounty | Average bounty per severity, plus each severity’s share of resolved reports | Badges for Fast Payment, Gold Standard Safe Harbor, Top Response Efficiency, Signal 1.0 requirement |
| Bugcrowd | 75% of submissions accepted or rejected within about 1 month (last 3 months) | 608 vulnerabilities rewarded, $366.66 average payout (last 3 months) | Scope rating 2 out of 4, started September 7, 2013 |
| Intigriti | A validation-time table per severity, from 2 to 15 working days | Bounty range per asset tier, from up to €1,500 to €13,337 | 10 requests per second limit, required username header |
| YesWeHack | First response under 1 day | Average and maximum reward shown as “-“ | 838 reports, 12 this month, last update January 21, 2025 |
This is not a ranking of platforms. The point is the format: once you know where each number sits, you can read any bug bounty program on that platform the same way. Our bug bounty platforms comparison covers how the platforms differ.
A big bounty from a program that takes three months to triage is worth less than a modest one paid in a week. A slow program also gives other hunters time to find your bug, and a duplicate usually earns nothing. On HackerOne, the averages on the page cover the last 90 days, and time to bounty runs from triage to payment.
HackerOne published a Bug Bounty Maturity Framework on March 30, 2026, and it works well as a scorecard for any bug bounty program, on any platform:
The platform’s own floor is looser. HackerOne’s response standards set a maximum of 5 business days to first response and 10 to triage. A bug bounty program that misses even those is one to skip.
HackerOne also shows a response efficiency percentage: the share of the last 90 days’ reports that met the program’s targets for first response and triage. The directory’s “High response efficiency” filter means at least 80%, and a program above 90% gets a Top Response Efficiency badge.
But the targets are set by the program. HackerOne recommends 1 business day for first response and 2 for triage, yet a team can choose slower ones. A 95% score against a slow target can be worse than 80% against a fast one. So read the average times next to the percentage, never the percentage alone.
HackerOne’s own bug bounty program is a useful example. Its Fast Payment highlight says payment arrives within one month of the report. Its average time from submission to bounty, shown a few lines lower, is 1 month, 1 week.
That does not prove anything bad, since a few slow reports can drag an average up, and the same page shows a 5-hour first response. It does show the habit worth building: a badge is a commitment, and the average is what actually happened.
Intigriti’s own bug bounty program prints a validation deadline per severity (2 working days for Critical, 5 for High, 15 for Medium and Low) and says a late validation may earn a €25 bonus, at its discretion. A team that puts money on its own deadline is telling you something.
Bugcrowd’s own engagement page shows how fast these figures move. On October 24, 2026, it said 75% of submissions were accepted or rejected within about one month. An older, undated copy of the same page in search results said 5 days. Check the number on the day you choose, not the day someone blogged about it, including this blog.
A maximum bounty is the bug bounty version of “up to 70% off” in a shop window. It is true, and almost nobody pays that price. What matters is the distribution.
HackerOne’s bug bounty program shows it plainly. Its rewards summary, last updated July 29, 2026, lists the 90-day average bounty for each severity and that severity’s share of resolved reports:
| Severity | Average bounty | Share of resolved reports |
|---|---|---|
| Low | $173 | 49.23% |
| Medium | $1,500 | 38.79% |
| High | $7,000 | 9.28% |
| Critical | $15,000 | 2.71% |
Weight those averages by those shares and a resolved report works out to roughly $1,720. That is our arithmetic, not a HackerOne figure, and it mixes a 90-day average with a lifetime share. It is still far more useful than $15,000.
Intigriti’s own bug bounty program pays by asset tier. A Tier 2 asset pays from €50 to €13,337, a Tier 3 asset from €50 to €5,000, and a Tier 4 asset up to €1,500. The headline range only applies to the top tier, so find the tier of the asset you plan to test first. A bug on the wrong host can pay a ninth of what you expected.
YesWeHack’s own program lists its average and maximum reward as “-“. On HackerOne, the directory documentation says a dash means there is no value or the program hid the metric. That is not a red flag on its own, but you have less to go on, so weigh the response and activity figures more.
Every bug bounty program has a hidden cost: the other hunters. No platform publishes how many people test a program, but the page leaves clues.
Bugcrowd scores scope breadth for you. Its scope rating adds one point for each of four tests: more than 5 targets, 10 or more targets, more than 2 wildcard domains, and 4 or more categories of target. Its own program scores 2 out of 4.
Wildcards matter most. A wildcard like *.example.com means you can find assets the team itself has forgotten, and recon pays off. A list of three fixed URLs means everyone tests the same three pages. Our guide to recon automation for bug bounty hunters covers how to work a wide scope without breaking a program’s rules.
HackerOne adds one more scope option worth looking for: Open Scope. On its own bug bounty program, this highlight means it rewards reports on any asset it owns, based on impact, even if the asset is not in the listed scope. Most programs are Closed Scope, the default, where only the listed assets count.
A bug bounty program can look perfect on response and payout and still be wrong for you, because of what it allows and who it lets in.
Safe harbor is the program’s promise not to pursue legal action against good-faith research inside its rules. It is the most important line on the page and the one most hunters scroll past.
On Bugcrowd, each program shows a full or partial safe harbor status based on the disclose.io standard. Bugcrowd’s safe harbor documentation says full status needs an exhaustive in-scope list, a clear rewards statement, defined contact channels and an explicit disclosure policy. Partial status, in Bugcrowd’s words, does not represent the same level of commitment.
On HackerOne, look for the Gold Standard Safe Harbor badge, and the separate AI Research Safe Harbor if you plan to test AI features. HackerOne’s January 2026 documentation says the AI version covers testing that is unique to AI systems, such as model behavior and safety bypasses. A bug bounty program without either badge needs a closer read of its legal text.
HackerOne lets each program set a Signal requirement, a score built from your report history over the last 365 days. Its signal requirements documentation lists settings from -1.0 to 7.0, with 0.0 the long-standing default and 1.0 described as a good starting point for new programs.
If your Signal is below a program’s requirement, you get 3 trial reports. After the third, you face a 90-day pause, which ends early if one of your reports is triaged or resolved. Waste those three on weak findings and you have locked yourself out for a quarter.
Real programs are using this. The Node.js project moved to a Signal of 1.0 after receiving over 30 reports between December 15 and January 15. Its February 19, 2026 update says new researchers without Signal can no longer report through HackerOne at all. If you are new, start where the gate is open, and our roadmap for new bug bounty hunters covers where that is.
Rate limits and tooling rules decide whether your workflow is even allowed. Three examples from the platforms’ own programs:
X-Intigriti-Username header on your traffic.X-Bug-Bounty header that names you or your tool, so it can tell your traffic apart from other testing.If you run scanners, a recon pipeline or an AI agent, a bug bounty program that forbids automation is the wrong program for that workflow, however good its payouts look. Pick one whose rules match how you work, then set your tools to the program’s limit before the first request.
Put the sections above together and you get one checklist. Score each line 0, 1 or 2, then compare programs by total, not by top bounty.
| Check | Where to find it | Green (2) | Red (0) |
|---|---|---|---|
| First response | Average time to first response | Under 2 business days | Over 5 business days |
| Triage | Average time to triage or validation table | Under 5 business days | Over 10 business days |
| Payment | Time to bounty, Fast Payment badge | Pays on triage or within 14 days | Over 2 months |
| Payout spread | Rewards summary or average payout | Low and Medium averages you would accept | Hidden, or most reports at the floor |
| Asset tier | Bounty table per asset | Your target is in the top tier | Your target is in the bottom tier |
| Competition | Launch date, report volume, scope changes | New program or new assets | Old program, fixed scope, heavy volume |
| Scope breadth | Scope rating, wildcards, Open Scope | Wildcards or Open Scope | A few fixed URLs |
| Safe harbor | Badge or status on the page | Full or Gold Standard | Partial or none |
| Access and tools | Signal requirement, automation rules | Open to you, allows your workflow | Gated, or bans your tools |
A total of 14 or more out of 18 is a strong bug bounty program for you. Under 9, keep looking. The scores are our suggestion, not a platform standard, and they are personal on purpose: the asset tier and tooling lines depend on what you are good at.
Most of these come from reading the top of the page and stopping.
If you do land a finding, our guide to bug bounty report writing covers how to get it through triage, which is where a good choice of program pays off.
Quick disclosure: XHack is my company, so read this section knowing that.
XHack AI is not a bug bounty platform. It does not choose a bug bounty program for you, submit reports, or promise that any report gets paid. Picking the program, reading its rules and staying inside them is your job, and section 6 of our terms says so in plain words: you test only what you are authorized to test, inside the scope and the rules of engagement.
Where it helps is the work after the choice. You give the agent the program’s scope, request limit and banned techniques in your instructions, and it runs recon and testing with up to 12 sub-agents in parallel by default, which matters on a wide-scope program where breadth is the bottleneck. Section 10.1 of our terms says AI output can be incomplete or wrong, so every finding needs your own reproduction before it carries your name. Our guide to the XHack AI agent for bug bounty has the detail.
XHack does not store your agent chats and cannot access them, so a program’s scope and your unreported findings stay with you. Access is gated by identity verification, a government ID plus a security credential.
Individual plans are $20 Starter, $49 Professional and $150 Elite per month, with a 7-day free trial: full access, one per customer, and nothing to cancel when it ends. Still deciding whether hunting is worth your time? Our honest take on whether bug bounty is worth it is a better first read than any pricing page, ours included.
Pick a bug bounty program with no Signal gate or a low one, fast average response times, safe harbor on the page, and a wide scope with wildcards. A newer program, or one with newly added assets, beats a famous one tested for a decade. Score your shortlist with the nine checks above and start with the highest total, not the highest bounty.
HackerOne’s March 2026 maturity framework sets the baseline at a human response within 3 business days (2 for a competitive program) and payment within 14 days. The platform maximum is 5 business days to first response and 10 to triage. Avoid a bug bounty program slower than that unless the payout is exceptional.
No. HackerOne’s own bug bounty program shows a $15,000 average for Critical, but only 2.71% of its resolved reports were Critical, while 49.23% were Low at a $173 average. Compare the averages and the share of reports at each level, and check which asset tier your target sits in.
Safe harbor is a bug bounty program’s promise not to take legal action against good-faith research done within its rules. On Bugcrowd, look for full rather than partial status. On HackerOne, look for the Gold Standard Safe Harbor badge, plus the AI Research Safe Harbor if you test AI features. Stay inside the scope either way, because the promise only covers research inside the rules.
The bug bounty program probably has a Signal requirement above your current score. HackerOne gives you 3 trial reports on such programs, then a 90-day pause after the third, which ends early if one of your reports is triaged or resolved. Build your Signal on open programs first.
Not on every bug bounty program. Intigriti’s own program allows automated tooling up to 10 requests per second, while YesWeHack’s asks hunters to refrain from automated tools. Read the rules of engagement first, set your tools to the program’s limit, and validate every AI-generated finding yourself before you submit it.
The best bug bounty program for you is rarely the one with the biggest number at the top. It replies within days, pays at levels you would accept, has scope that is not picked clean, protects you legally, and allows the way you work. Every one of those facts is on the program page.
Spend ten minutes scoring three candidates before your next hunt. Start with the response averages, then the payout spread, then the rules. For the hunt itself, our bug bounty methodology picks up where this guide stops, and our pillar on AI for bug bounty covers where tooling actually helps once you have chosen.
Categories
Related articles
