Leaderboard
Ranked on what was proven.
Reputation only moves on triage outcomes. Signal is the average severity of your valid reports; impact weighs it by bounty. Nothing here is affected by how many reports you file.
#1🇩🇪
@nullwave
Authentication · SSRF · Business logic
Reputation
18.4k
Valid
214
Streak
31w
#2🇬🇧
@saltmarsh
SAML · OAuth · Session
Reputation
16.9k
Valid
189
Streak
18w
#3🇳🇬
@kestrel_0x
IDOR · GraphQL · Mobile
Reputation
15.2k
Valid
173
Streak
44w
| # | Hunter | Reputation | Reputation | Signal | Impact | Valid | Specialties |
|---|---|---|---|---|---|---|---|
| 4 | @mirabel🇫🇷 | 14.5k | 14,480 | 7.6 | 30.1 | 121 | Cryptography, Smart contracts |
| 5 | @deadbeef_🇺🇸 | 14k | 13,970 | 6.2 | 25.9 | 240 | Request smuggling, Cache, CDN |
| 6 | @yara.v🇧🇷 | 12.8k | 12,850 | 6.9 | 26.4 | 134 | Web, Race conditions |
| 7 | @hex_tide🇮🇳 | 12.3k | 12,310 | 6.5 | 24.7 | 158 | API, Mass assignment |
| 8 | @ovis🇳🇱 | 11.7k | 11,740 | 7.0 | 27.0 | 98 | Kubernetes, Cloud |
| 9 | @ptr_null🇵🇱 | 11k | 11,020 | 6.4 | 23.9 | 142 | Desktop, Electron |
| 10 | @quietcoil🇯🇵 | 10.6k | 10,580 | 7.2 | 28.3 | 77 | Mobile, Reverse engineering |
| 11 | @lanternfish🇦🇺 | 10k | 9,960 | 6.1 | 22.8 | 150 | XSS, CSP |
| 12 | @rook🇿🇦 | 9.4k | 9,410 | 6.7 | 25.1 | 89 | Business logic, Payments |
| 13 | @vesper.sh🇪🇸 | 8.9k | 8,870 | 6.3 | 23.2 | 104 | SSRF, Cloud metadata |
| 14 | @tangent🇨🇦 | 8.4k | 8,390 | 5.9 | 21.6 | 131 | Web, Recon |
| 15 | @ilse🇸🇪 | 7.9k | 7,920 | 7.3 | 29.0 | 46 | WebAuthn, OIDC |
| 16 | @mokuren🇰🇷 | 7.5k | 7,450 | 6.6 | 24.4 | 83 | Mobile, Deep links |
| 17 | @sable🇦🇷 | 7k | 6,980 | 6.0 | 22.1 | 112 | IDOR, Access control |
| 18 | @glasswing🇵🇹 | 6.4k | 6,410 | 6.8 | 26.2 | 54 | Smart contracts, DeFi |
| 19 | @n0ctis🇪🇬 | 5.9k | 5,880 | 5.7 | 20.9 | 97 | Web, File upload |
| 20 | @fennel🇮🇪 | 5.3k | 5,320 | 7.5 | 30.4 | 31 | Request smuggling, HTTP/2 |