Leaderboard
Ranked on what was proven.
Reputation only moves on triage outcomes. Signal is the average severity of your valid reports; impact weighs it by bounty. Nothing here is affected by how many reports you file.
#1🇫🇷
@mirabel
Cryptography · Smart contracts
Signal
7.6
Valid
121
Streak
9w
#2🇮🇪
@fennel
Request smuggling · HTTP/2
Signal
7.5
Valid
31
Streak
10w
#3🇩🇪
@nullwave
Authentication · SSRF · Business logic
Signal
7.4
Valid
214
Streak
31w
| # | Hunter | Signal | Reputation | Signal | Impact | Valid | Specialties |
|---|---|---|---|---|---|---|---|
| 4 | @ilse🇸🇪 | 7.3 | 7,920 | 7.3 | 29.0 | 46 | WebAuthn, OIDC |
| 5 | @quietcoil🇯🇵 | 7.2 | 10,580 | 7.2 | 28.3 | 77 | Mobile, Reverse engineering |
| 6 | @saltmarsh🇬🇧 | 7.1 | 16,930 | 7.1 | 29.8 | 189 | SAML, OAuth, Session |
| 7 | @ovis🇳🇱 | 7.0 | 11,740 | 7.0 | 27.0 | 98 | Kubernetes, Cloud |
| 8 | @yara.v🇧🇷 | 6.9 | 12,850 | 6.9 | 26.4 | 134 | Web, Race conditions |
| 9 | @kestrel_0x🇳🇬 | 6.8 | 15,210 | 6.8 | 27.5 | 173 | IDOR, GraphQL, Mobile |
| 10 | @glasswing🇵🇹 | 6.8 | 6,410 | 6.8 | 26.2 | 54 | Smart contracts, DeFi |
| 11 | @rook🇿🇦 | 6.7 | 9,410 | 6.7 | 25.1 | 89 | Business logic, Payments |
| 12 | @mokuren🇰🇷 | 6.6 | 7,450 | 6.6 | 24.4 | 83 | Mobile, Deep links |
| 13 | @hex_tide🇮🇳 | 6.5 | 12,310 | 6.5 | 24.7 | 158 | API, Mass assignment |
| 14 | @ptr_null🇵🇱 | 6.4 | 11,020 | 6.4 | 23.9 | 142 | Desktop, Electron |
| 15 | @vesper.sh🇪🇸 | 6.3 | 8,870 | 6.3 | 23.2 | 104 | SSRF, Cloud metadata |
| 16 | @deadbeef_🇺🇸 | 6.2 | 13,970 | 6.2 | 25.9 | 240 | Request smuggling, Cache, CDN |
| 17 | @lanternfish🇦🇺 | 6.1 | 9,960 | 6.1 | 22.8 | 150 | XSS, CSP |
| 18 | @sable🇦🇷 | 6.0 | 6,980 | 6.0 | 22.1 | 112 | IDOR, Access control |
| 19 | @tangent🇨🇦 | 5.9 | 8,390 | 5.9 | 21.6 | 131 | Web, Recon |
| 20 | @n0ctis🇪🇬 | 5.7 | 5,880 | 5.7 | 20.9 | 97 | Web, File upload |