Real targets. Fair calls. Reputation that travels.
Hunt authorized programs with clear scope, submit evidence-backed reports, and get transparent severity and bounty decisions. Free to join — from your first lab to your first critical and every bounty after.
Built as a growth engine for legitimate researchers.
Real, clear targets
Search by company, technology and vulnerability type. Know exactly what is authorized before you send a request.
Structured reports
A guided form for title, asset, type, steps, impact and evidence — simple for first-timers, ready for triage.
Fair rewards
Transparent severity and bounty decisions, visible payout status, and a two-sided rating that holds companies accountable too.
Verified reputation
Valid findings, severity mix, acceptance rate and skill badges build a profile you carry across every program.
Learn & labs
Progressive labs and CTF challenges build verified skills, then move you straight into live programs.
Appeals & disputes
Every decision is explained and appealable, with a clear dispute workflow when you disagree.
From first lab to first critical.
Learn
Build skills with hands-on labs across web, API, auth and cloud.
Hunt
Pick an in-scope program and test authorized targets.
Report
Submit a clear, evidence-backed report through the guided form.
Earn
Get paid by severity and grow portable reputation.
Keep learning. Keep sharing. Keep hunting together.
Blog
Bug bounty talks
Newsletter
The Coconut Dispatch — new programs, write-ups and payouts, every two weeks. No noise.
Community
Trade techniques, find collaborators and get help with a stuck target. Real researchers, no gatekeeping.