01
Why it is good for you
Each card explains your fit: which surface dominates, your effective skill there, stack match, and the personal delta with its ±12 point cap.
Rebuilt every 6 hours
checking the last crawl
Hunt where you can actually win.
Bug bounty programs, aggregated from four platforms and two community mirrors, then ranked on whether they pay, how crowded they are, and whether the scope fits the skills you really have.
221
programs scored
100
pay reliably
2,954
in the catalog
6
sources merged
Pays reliably
58.3
Marriott Bug Bounty Program
301 assets · 97% response · paid in the last 90 days
Your fit
+6.1 pts
web98%
api42%
mobile6%
Why it ranks: responds fast, pays often, and most of the scope
is web, where your effective skill is 4.2 of 5.
Aggregated from
HackerOne
Bugcrowd
Intigriti
YesWeHack
arkadiyt
lissy93
What the index shows you
Not just a list of programs. Every row answers a question you would otherwise settle by opening ten tabs.
02
Compare up to four
Score, crowding, response, paid in 90 days, age and slop risk in one table. Winners are only marked when the margin is real.
03
Filter by what you can test
Web, API, mobile, network, cloud, hardware and IoT, smart contracts, source and AI. Tick the categories you can actually work in.
04
See what changed
New programs, new scope assets and removed scope are diffed every crawl. The bell in the app bar lists the changes.
Open data
Scrape the catalog for your own models
Every program, scope, badge and score is published as JSON. Pull it into a notebook, a RAG index or your own agent. No key and no API quota beyond GitHub Pages.
Prize size is not the signal.
The biggest number on a program page is not the number most hunters can win. honeybe ranks on the three things that decide whether a weekend turns into a payout.
01 · Will it pay?
Payout behaviour, not promises
Response efficiency, bounties paid in the last 90 days, self-missed SLAs and dormancy. Programs that miss their own targets are marked.
Pays reliably
Pays slowly
Risky
02 · Can you get in?
Crowding, per asset
Raw report counts punish huge scopes. honeybe divides reports by assets, so a broad program is not treated like a crowded one.
03 · Does it fit you?
Your stack, scaled honestly
Ten surfaces, your level, tools and time. Personalisation can move a score by at most 12 points, so it reorders without inventing.
web4.2 / 5
api3.1 / 5
mobile1.0 / 5
bounded to ±12 points
Built on measured behaviour.
The weights are not a vibe. Each primary axis comes from published research on how bounty hunters and programs actually behave.
Age
Maillart et al.
Discovery probability decays as t^-0.40 after
launch, measured across 35 public HackerOne programs.
Hunter priorities
Akgul et al.
In a survey of 159 hunters, responsiveness and payout disputes beat prize size as reasons to leave a program.
arXiv:2301.04781Fairness
Zheng et al.
Across 9,942 reports, reputation won 59.85% of near-identical pairs. honeybe does not model it, because you cannot see it fairly.
arXiv:2511.18608Live from the index
The current top five, before your profile moves the order.
Stop guessing which program deserves your weekend.
Free, open source, no account. Your profile stays in your browser.