Priced on outcomes, not seats.
Companies pay for the security work that lands — valid findings and, optionally, managed triage. There are no per-seat licenses and no charge to publish a program. Researchers never pay a cent.
A disclosure channel for good-faith reports. Start receiving today.
Pay bounties you set, plus a fee only on findings you accept.
Everything in Bounty plus expert triage run as a service.
Indicative packaging for demonstration. Contact sales for current pricing and volume terms.
Everything, side by side.
| Feature | VDP | Bounty | Managed |
|---|---|---|---|
| Public disclosure policy | ✓ | ✓ | ✓ |
| Structured report intake | ✓ | ✓ | ✓ |
| Private programs | — | ✓ | ✓ |
| Reputation-based invites | — | ✓ | ✓ |
| Severity-to-bounty tables | — | ✓ | ✓ |
| Remediation & retest | — | ✓ | ✓ |
| Managed expert triage | — | Add-on | ✓ |
| SLA & response reporting | — | — | ✓ |
| Compliance exports | — | — | ✓ |
| Dedicated support | Community | Dedicated |
Free for researchers. Always.
Join programs, submit reports, build reputation and get paid full bounties. We take our fee from companies, never from your payout.
Pricing, answered.
When am I charged?
Only when you accept a valid finding and pay its bounty. Publishing a program and receiving reports is free.
Do researchers pay anything?
No. Researchers keep their full bounty. The platform fee is billed to the company, separate from the payout.
Can I add triage later?
Yes. Managed triage is an add-on on Bounty and included on Managed. Turn it on per program whenever you need it.
Is there a minimum commitment?
No lock-in on VDP or Bounty. Managed plans are scoped to your program and agreed with sales.