Leaderboard
Ranked on what was proven.
Reputation only moves on triage outcomes. Signal is the average severity of your valid reports; impact weighs it by bounty. Nothing here is affected by how many reports you file.
#1🇩🇪
@nullwave
Authentication · SSRF · Business logic
Earned, 90d
$86k
Valid
214
Streak
31w
#2🇬🇧
@saltmarsh
SAML · OAuth · Session
Earned, 90d
$74.5k
Valid
189
Streak
18w
#3🇳🇬
@kestrel_0x
IDOR · GraphQL · Mobile
Earned, 90d
$69k
Valid
173
Streak
44w
| # | Hunter | Earned, 90d | Reputation | Signal | Impact | Valid | Specialties |
|---|---|---|---|---|---|---|---|
| 4 | @deadbeef_🇺🇸 | $61k | 13,970 | 6.2 | 25.9 | 240 | Request smuggling, Cache, CDN |
| 5 | @mirabel🇫🇷 | $52k | 14,480 | 7.6 | 30.1 | 121 | Cryptography, Smart contracts |
| 6 | @ovis🇳🇱 | $48k | 11,740 | 7.0 | 27.0 | 98 | Kubernetes, Cloud |
| 7 | @yara.v🇧🇷 | $44k | 12,850 | 6.9 | 26.4 | 134 | Web, Race conditions |
| 8 | @ilse🇸🇪 | $41k | 7,920 | 7.3 | 29.0 | 46 | WebAuthn, OIDC |
| 9 | @hex_tide🇮🇳 | $39.5k | 12,310 | 6.5 | 24.7 | 158 | API, Mass assignment |
| 10 | @fennel🇮🇪 | $38k | 5,320 | 7.5 | 30.4 | 31 | Request smuggling, HTTP/2 |
| 11 | @quietcoil🇯🇵 | $36k | 10,580 | 7.2 | 28.3 | 77 | Mobile, Reverse engineering |
| 12 | @rook🇿🇦 | $33k | 9,410 | 6.7 | 25.1 | 89 | Business logic, Payments |
| 13 | @ptr_null🇵🇱 | $31k | 11,020 | 6.4 | 23.9 | 142 | Desktop, Electron |
| 14 | @glasswing🇵🇹 | $29k | 6,410 | 6.8 | 26.2 | 54 | Smart contracts, DeFi |
| 15 | @lanternfish🇦🇺 | $27k | 9,960 | 6.1 | 22.8 | 150 | XSS, CSP |
| 16 | @mokuren🇰🇷 | $24.5k | 7,450 | 6.6 | 24.4 | 83 | Mobile, Deep links |
| 17 | @vesper.sh🇪🇸 | $22k | 8,870 | 6.3 | 23.2 | 104 | SSRF, Cloud metadata |
| 18 | @tangent🇨🇦 | $19.5k | 8,390 | 5.9 | 21.6 | 131 | Web, Recon |
| 19 | @sable🇦🇷 | $15k | 6,980 | 6.0 | 22.1 | 112 | IDOR, Access control |
| 20 | @n0ctis🇪🇬 | $12.5k | 5,880 | 5.7 | 20.9 | 97 | Web, File upload |