About
Ratings for the programs, by the researchers.
BugRater is an independent directory that rates bug bounty and vulnerability disclosure programs the way the people who actually work them experience them — triage speed, payout fairness, communication, scope honesty, and whether they’d submit to that program again.
Why balanced reviews
Complaint walls tell you where not to go. That’s only half the map. The reviews that change how you spend your week are the good ones — they tell you where solid, fast, fair programs are hiding. We collect both, through one standardized form, so every rating is comparable and every grade means the same thing across programs.
How grades are computed
Each program earns a letter grade from a weighted composite of reported outcomes: would-submit-again rate, whether it pays its advertised range, payout fairness, median time to first response, communication, and acceptance rate. Reviews from researchers who’ve verified a platform account count double. A program needs at least 3 reviews before it’s graded.
Moderation
Every review is submitted by an account holder and moderated before publishing. Ratings reflect reported experiences, not endorsements — and programs can claim their profile to respond on the record.
What we won't do
We've written down what we will and won't do — including that we'll never ask for a government ID, and that we never touch the money between a researcher and a program. Read our founding principles and hold us to them.