Bug Bounty Platforms evaluated across fee disclosure & take rate, dispute recourse when payment is refused, advertised maximum vs actually paid, and coverage model & blockchain depth.
Immunefi
#1 of 7 · published ranking
Immunefi
79ChainChoice Score
4199
Why it leads
Best in the pool on model depth (9/10; next 8/10)
Cost
Not priced· No comparable price is published
No provider can pay for a position in this table. The code that computes this order cannot read which links earn us a commission, and every build proves it. Every score below rebuilds from the published criteria.Ranking 2026.08 · 4 criteria · 7 products · same inputs, same order
Personal comparison
Bug Bounty Platforms ranked comparison
No comparable price is published; ranking still uses verified product evidence.
Ranked on 4 published criteria weighted 30/30/25/15, which set goal alignment — 30 of the 86 points. The rest: regional access 20, evidence depth 18, ease of use 10, institutional trust 8. Profile match is shown in breakdowns but carries no weight.
Audit
Infrastructure
Methodology
2026.09.15
published 2026-09-16
Providers tracked
980+
across 119 categories
Last verified
2026-09-14
newest dated pricing or sentiment read
Named on the roster
2 people
managing directors · 6 automated processes
Decision guide
What matters most before choosing in this category
A bounty platform is not an audit, and this page scores it as what it is: a standing offer to pay strangers for bugs. The decisive questions are whether the platform discloses its fee and take rate, what recourse a researcher has when a payment is refused, and how the advertised maximum compares with what has actually been paid — headline ceilings in this market are marketing, and are shown as facts rather than scored.
What matters most before choosing in this category
A bounty platform is not an audit, and this page scores it as what it is: a standing offer to pay strangers for bugs. The decisive questions are whether the platform discloses its fee and take rate, what recourse a researcher has when a payment is refused, and how the advertised maximum compares with what has actually been paid — headline ceilings in this market are marketing, and are shown as facts rather than scored.
Do you want continuous coverage of deployed code, or a time-boxed contest before launch?
Do you know what percentage the platform takes from a payout, and is it published?
What happens if you and a researcher disagree about severity — who decides, and can it be appealed?
Default starting point
Expert review and scoring weights
Immunefi
ImmunefiData checked Sep 2026
Crypto-native continuous bug bounty marketplace with binding arbitration
Crypto-native continuous bug bounty marketplace with binding arbitration. Strongest on coverage model & blockchain depth (9/10): Deepest crypto-native continuous-bounty footprint: "$125M+" paid, "83,000+ registered security researchers", "500+ protocols" (immunefi.com/bug-bounty-program/), plus audit competitions, and it is absorbing Code4rena's bounty customers and researchers after that platform's 13 May 2026 wind-down. Weakest on dispute recourse when payment is refused (5/10): immunefi.com/rules/ prohibits "Disputing a bug report in the dashboard once it has been paid or marked as closed, with the exception of requesting mediation"; in the directory's data 123 of 176 programmes are "Pay to Mediate" (20 of them "No Free Mediations") and arbitration — "The expected output is a final binding decision on a report, followed by enforcement (as required) of the bounty reward from the Project to the Security Researcher" — is enabled on 19 of 176. On advertised maximum vs actually paid (6/10): Immunefi's own blog publishes "The median payout for a critical is $20,000 . The mean sits at $114,355" against "$107.3 million in awards for confirmed critical vulnerabilities alone"; the public directory lists 176 programmes and marks "Total Paid" as Private on 146, while 30 disclose a figure (The Graph 1,595,724; Immunefi's own programme 76,128; Polygon "Total paid 8.2M from 86 paid reports"). Published price: "the subscription removes the 10% platform fee on all payouts" — i.e. the default is a 10% platform fee on every payout.
Best forCoverage model & blockchain depth — 9/10
Main tradeoffIts rulebook is no longer public. The support articles defining "No Fix, No Pay", Issuing Payouts and Arbitration Overview all now return a login wall ("Login to your account | Immunefi") — you cannot read the terms that govern whether you get paid until after you sign up. And the "no fix, no pay" rule itself means a project that acknowledges your critical but declines to fix it owes you nothing; immunefi.com/rules/ only references the rule obliquely, listing "Abusing the 'no fix, no pay' rule by stealth fixing the bug later without providing full payment to the whitehat" as prohibited conduct.
Verify before signup"the subscription removes the 10% platform fee on all payouts" — i.e. the default is a 10% platform fee on every payout. The annual subscription price that removes it is NOT published; three tiers (BBP Subscription "Annual flat fee, zero commission on payouts", Enterprise Subscription, Premium BBP) are listed with no dollar amounts.
Methodology
How this category is reviewed
Reviewed on fee disclosure & take rate, dispute recourse when payment is refused, advertised maximum vs actually paid, and coverage model & blockchain depth.
The order on this page is the published ranking for this category. Every criterion, weight and source behind it is on the methodology page.
Frequently asked
Questions people ask before choosing bug bounty platforms
Does a large advertised bounty mean large payouts?
No. The headline maximum is a marketing ceiling and is shown here as a fact, never scored as an achievement. What is scorable is whether the platform lets anyone verify the gap between what it advertises and what it has genuinely paid.
Why does coverage model carry the least weight?
Because it is the most visible difference and the easiest to check yourself. A contest covers a commit for a window; continuous coverage follows deployed code afterwards. The harder questions — what the platform keeps, and what recourse exists when a payout is refused — carry 60% between them.
What matters most when picking an bounty platform?
Fee disclosure and dispute recourse — 60% of the weight between them. They are the two things a researcher cannot discover until it is too late.
Not financial advice · For informational purposes only · Always do your own research
//Analytics consent·GDPR · ePrivacy · TTDSG
ChainChoice measures page views and conversions with two cookieless, EU-hosted services: Plausible and Cloudflare Web Analytics. Nothing loads until you accept, and rankings are identical either way.ChainChoice measures how the engine is used — page views, conversions, referrer — through two cookieless, EU-hosted services: Plausible and Cloudflare Web Analytics. No advertising cookies, no cross-site profile, no data resale. Neither script loads until you accept, and rankings are identical whether you accept or decline.
