Earn from what you find
Finding and reporting vulnerabilities responsibly is paid work. The legitimate route is coordinated disclosure through a program that has invited you to test — and it can be lucrative, repeatable and entirely lawful.
How it pays
You find a flaw in software or a service whose owner runs a bounty or disclosure program, report it privately through their channel, help them fix it, and are rewarded — in money, recognition, or both. The vulnerability is disclosed and gets a CVE; the PoC can then be shared with the community, which is where a feed like this one comes in.
Bug bounty platforms
- HackerOne
The largest bug bounty platform; thousands of programs across every industry.
- Bugcrowd
Crowdsourced programs and managed VDPs.
- Intigriti
European platform with a strong public-program catalogue.
- YesWeHack
Global platform, large public scope.
- huntr
Bounties specifically for open-source and the AI/ML stack — the same software this feed tracks.
Vendor programs and competitions
Contribute here
Once a vulnerability is publicly disclosed, you can add your proof of concept to its page on this feed. It builds your public track record and helps defenders understand the risk. It is a contribution, not a sale — see the boundary below.
Start from what is already being exploited, or open any CVE and use “Submit a proof of concept”.
Where the line is
This platform does not buy, sell, or broker exploits, and never pays for submissions. Community contributions are for published vulnerabilities only.
Only ever test systems you own or have explicit, written permission to test. Selling exploits or vulnerability details outside an authorised program, or to grey- or black-market buyers, is a different activity entirely — frequently illegal, and not something this site facilitates or endorses. Unauthorised access to computer systems is a crime in most jurisdictions (for example the US Computer Fraud and Abuse Act and the UK Computer Misuse Act).
This is general information, not legal advice. See the terms.