// the archive in numbers

Insights

Every figure below is computed live from the 14,046 disclosure records in the archive. Bounty totals reflect only what each platform publishes; competitive-audit platforms rarely attach a figure.

14,046
disclosures
$4.01M
bounty tracked
2,115
reference a CVE
780
programs
5,617
researchers
14
years covered
144 disclosures reference a CVE now in CISA’s Known Exploited Vulnerabilities catalogue — weaknesses confirmed exploited in the wild. Browse them →301 disclosures reference a CVE that EPSS scores at a 50%+ chance of exploitation in the next 30 days (FIRST.org). Rank by likelihood →

Over time

Disclosures per year
1,6861,038'13'15'17'19'21'23'25'26
Show the numbers
YearDisclosuresBounty
20138$2,250
2014484$33,145
2015539$111,055
20161,180$368,160
20171,686$230,700
2018978$255,020
20191,213$453,354
20201,467$352,951
20211,423$600,900
20221,155$657,874
2023932$362,709
2024946$240,224
2025995$236,594
20261,038$101,345
Bounties awarded per year
$657,874$101,345'13'15'17'19'21'23'25'26

Severity, platform & class

By severity
Critical
1,082
High
2,051
Medium
3,841
Low
2,472
Informational
292
None
3,779
Unrated
529
By platform
HackerOne
12,724 · $3,969,446
Bugcrowd
813 · $7,400
Code4rena
410
Immunefi
92 · $21,435
Intigriti
6 · $8,000
YesWeHack
1
Most common vulnerability classes
Authentication / Account Takeover
2,235
Cross-Site Scripting (XSS)
2,200
Information Disclosure
1,808
Broken Access Control / Privesc
1,295
Business Logic / Secure Design
1,130
Denial of Service
901
Remote Code / Command Execution
842
Memory Safety (native)
840
Cross-Site Request Forgery (CSRF)
554
Cryptography / TLS
485
Smart Contract / Web3
435
IDOR / Broken Object-Level Auth
380
Show the numbers
ClassDisclosures
Authentication / Account Takeover2,235
Cross-Site Scripting (XSS)2,200
Information Disclosure1,808
Broken Access Control / Privesc1,295
Business Logic / Secure Design1,130
Denial of Service901
Remote Code / Command Execution842
Memory Safety (native)840
Cross-Site Request Forgery (CSRF)554
Cryptography / TLS485
Smart Contract / Web3435
IDOR / Broken Object-Level Auth380

Researchers & programs

Top researchers by bounty earned
vakzz
$289,520 · 25 reports
saltyyolk
$96,500 · 8 reports
theflow0
$87,500 · 8 reports
orange
$80,060 · 22 reports
haxta4ok00
$78,300 · 35 reports
alexbirsan
$78,050 · 13 reports
albinowax
$72,700 · 20 reports
h72
$63,500 · 7 reports
hhj4ck
$61,500 · 22 reports
joaxcar
$59,330 · 13 reports
Show the numbers
ResearcherBountyReports
vakzz$289,52025 reports
saltyyolk$96,5008 reports
theflow0$87,5008 reports
orange$80,06022 reports
haxta4ok00$78,30035 reports
alexbirsan$78,05013 reports
albinowax$72,70020 reports
h72$63,5007 reports
hhj4ck$61,50022 reports
joaxcar$59,33013 reports
Most-disclosed programs
U.S. Dept Of Defense
895 · $10,000
Internet Bug Bounty
817 · $591,448
curl
684
Nextcloud
622 · $42,903
HackerOne
614 · $357,400
National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
507
Shopify
467 · $289,852
Node.js third-party modules
307 · $250
GitLab
258 · $627,340
X / xAI
250 · $86,949
Show the numbers
ProgramDisclosuresBounty
U.S. Dept Of Defense895$10,000
Internet Bug Bounty817$591,448
curl684—
Nextcloud622$42,903
HackerOne614$357,400
National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program507—
Shopify467$289,852
Node.js third-party modules307$250
GitLab258$627,340
X / xAI250$86,949

Exploitation risk

EPSS — probability of exploitation
90–100%
165
50–90%
136
10–50%
227
under 10%
1,566
Show the numbers
EPSS bandDisclosures
90–100%165
50–90%136
10–50%227
under 10%1,566
Known-exploited (KEV) findings per year
335'14'16'19'21'23'25'26

Bounty economy

Bounty size distribution
$10k+
93
$5k–10k
107
$1k–5k
702
$500–1k
680
$100–500
681
under $100
109
Bounty paid by severity
Critical
$1.12M
High
$1.37M
Medium
$746,622
Low
$218,671
None
$522,972
Unrated
$36,835
Largest single bounties
Github access token exposure
$50,000 · HackerOne
[Pre-Submission][H1-4420-2019] API access to Phabricator on code.uberinternal.com from leaked certificate in git repo
$40,000 · HackerOne
Account Takeover via Password Reset without user interactions
$35,000 · HackerOne
Remote Command Execution via Github import
$33,510 · HackerOne
RCE via the DecompressedArchiveSizeValidator and Project BulkImports (behind feature flag)
$33,510 · HackerOne
RCE via npm misconfig -- installing internal libraries from the public registry
$30,000 · HackerOne
Arbitrary file read via the bulk imports UploadsPipeline
$29,000 · HackerOne
Exposed Kubernetes API - RCE/Exposed Creds
$25,000 · HackerOne

What recurs, what resonates

Most-referenced CVEs
CVE-2020-3452
19
CVE-2018-6389
15
CVE-2018-0296
12
CVE-2020-14179
10
CVE-2021-44228
10
CVE-2022-27774
10
CVE-2022-27782
10
CVE-2020-3187
9
CVE-2020-3580
9
CVE-2019-11510
8
Most-voted disclosures
Takeover an account that doesn't have a Shopify ID and more
2,983 · HackerOne
Bypass for #488147 enables stored XSS on https://paypal.com/signin again
2,683 · HackerOne
Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSO
1,909 · HackerOne
Account takeover via leaked session cookie
1,622 · HackerOne
Github access token exposure
1,514 · HackerOne
Arbitrary file read via the UploadsRewriter when moving and issue
1,496 · HackerOne
Token leak in security challenge flow allows retrieving victim's PayPal email and plain text password
1,403 · HackerOne
RCE on Steam Client via buffer overflow in Server Info
1,287 · HackerOne

Counts include every indexed disclosure; a report can carry more than one vulnerability class, so class figures sum to more than the total. Explore any slice in the archive or via the API.

Insights — Open Security Research Archive