Curated Bug Bounty Programs

Jupiter

jup.ag

Solana DEX aggregator. Full perimeter — frontend, routing, wallet surfaces, APIs.

Jito

jito.network

Solana MEV infrastructure. All Jito-maintained systems in scope.

Digital product marketplace. Affiliate tracking, vendor dashboards, payment flows. $5K critical, $10K+ special bounty for DB extraction.

Product launch platform. JV registration, checkout flows, affiliate commissions. $5K critical, $10K+ special bounty for DB extraction.

All-in-one shopping cart & affiliate management. Checkout, subscriptions, CRM, API integrations. $5K critical, $10K+ special bounty for DB extraction.

SellApp

sell.app

Commerce platform. APIs, storefront, embed checkout, webhooks.

SellAuth

sellauth.com

Identity & licensing. Auth, OAuth, sessions, integrations.

BiteCo

biteco.one

Platform services. Full BiteCo-operated perimeter in scope.

BitFix

bitfix.pro

Crypto exchange. Trading APIs, custody, withdrawals, admin consoles.

Dex

dex.fo

DEX frontend & routing. Quotes, wallet connect, indexers.

AmlGroup

amlgroup.top

Exchange / mixer. Pool accounting, payout routing, custody.

Blexch

b1exch.to

Crypto exchange. Spot UI, REST + WebSocket APIs, custody.

Motomix

motomix.cc

Mixer / exchange. Treasury integrity, privacy-set bookkeeping.

TV-Hub

tv-hub.org

Crypto trading signals & automation. API key theft, trade execution bypass, signal manipulation, DB access.

AIQuant

aiquant.tools

AI-powered crypto quant trading. Model manipulation, fund theft, DB exploits, admin access — full perimeter.

Bitdo

bitdo.ai

Chinese crypto trading & AI signals. API key theft, DB access, admin takeover, signal manipulation — $5K critical.

Indonesia car marketplace. Fraud, theft, admin access, user DB leaks.

Car sales landing page. Fraud, theft, admin access, user DB leaks.

ETZ Swap

etz-swap.com

Crypto swap / exchange. Routing, wallet flows, bridge hooks.

MT Exchange

mt.exchange

Crypto exchange. Trading UIs, REST + WebSocket, deposit/withdraw.

Upbit ID

id.upbit.com

Indonesian CEX. Web, APIs, trading, custody — full perimeter.

Wielton

wielton.com.pl

Special vehicles & semi-trailers. Configurators, dealer portal.

Crypto exchange & trading. Full CEX surface, custody, APIs.

University student portal & LMS. Auth, APIs, academic infra.

Commonwealth Bank. NetBank, app, CommSec, APIs, cards.

Universiti Kebangsaan Malaysia. Full institutional scope — web, apps, APIs, infra, SSO, payment, IoT.

UTM Space

space.utm.my

Universiti Teknologi Malaysia. Student portal, LMS, SSO, APIs, payments, full institutional scope.

UPM Study Portal

study.upm.edu.my

Universiti Putra Malaysia. Student portal, LMS, SSO, APIs, payments, full institutional scope.

UTAR Edu Portal

utar.edu.my

Universiti Tunku Abdul Rahman. Student portal, admin panels, LMS, databases, APIs, SSO, payments — full institutional scope.

Tiki

tiki.vn

Vietnam e-commerce marketplace. Web, mobile, APIs, admin panels, databases — database access is primary target.

9YYL0 Casino

h5.9yyl0.com

Chinese online casino platform. Admin access, database breaching, game APIs, payment pipelines, full perimeter.

TAR UMT Portal

tarc.edu.my

Tunku Abdul Rahman University of Management and Technology. Student portal, admin panels, LMS, databases, APIs, SSO, payments — full institutional scope.

Crypto trading optimizer. Fund theft, database exploits, admin access — the three core bounty targets.

HalalMM

halalmm.com

Crypto middleman & escrow platform. Escrow theft, unauthorized release, dispute manipulation.

ZenLand

zen.land

P2P crypto marketplace & escrow. Theft, unauthorized release, dispute manipulation.

MidMan

midman.io

Crypto middleman & escrow service. Deposit theft, release bypass, dispute tampering.

LocalCoinSwap

localcoinswap.com

P2P crypto exchange with escrow. Fund theft, release races, admin compromise.

HodlHodl

hodlhodl.com

P2P Bitcoin exchange with multisig escrow. Key theft, signature bypass, dispute fraud.

Bitsgap

bitsgap.com

Crypto trading bots & exchange aggregator. Funds theft, DB access, admin access — full perimeter.

ITL996

itl996.com

Chinese online casino. Admin access priority, payment rails, game manipulation — full perimeter.

PlyDirect

plydirect.co.uk

UK e-commerce for plywood & building supplies. Admin access, shell/RCE, XSS, file upload, DB extraction.

Roofing Tools

roofing-tools.com

US e-commerce for roofing supplies & tools. Admin access, shell/RCE, XSS, file upload, DB extraction.

AFE Power

afepower.com

US e-commerce for auto performance parts. Admin access, shell/RCE, XSS, file upload, DB extraction.

Acorn MFG

acornmfg.com

US manufacturing & industrial e-commerce. Admin access, shell/RCE, XSS, file upload, DB extraction.

247 Blinds

247blinds.co.uk

UK e-commerce for blinds, curtains & shutters. Admin access, shell/RCE, XSS, file upload, DB extraction.

A4Tech

a4tech.ua

Ukrainian e-commerce for computer peripherals. Admin access, shell/RCE, XSS, file upload, DB extraction.