Sign up with a username, your email and a password of at least 12 characters. We send a 6-digit code to verify the email, then you set up an authenticator app (Google Authenticator, 1Password, Aegis…) by scanning a QR code. Keep the 10 recovery codes somewhere safe: they are the only way in if you lose your phone. More in Your account.
Then sign the researcher agreement in Settings → Agreements, with the mouse or by uploading a signed copy. You need it to send reports and receive bounties (see Agreements).
In Settings → Profile add a picture, a short description, your website and location. Choose whether the profile is public (your username appears on hacktivity and the leaderboard) or private (you appear as “a researcher”). You can change your username once every 7 days; nobody else can take a name that is already in use, in any letter case.
On Programs every entry shows its type, top reward and how many reports it resolved. Before testing anything, read the program’s guidelines and scope:
Companies can invite you to private programs. Invitations appear on your dashboard under Private programs, and you also get an email. After you accept, the program appears in your program list with a Private label, and you can report to it like any other program. Please keep what you learn there confidential.
Use Submit a report on the program page. See Writing a good report for what each field means. Found it with someone? Add them as collaborators and split the bounty and the points (see Reporting as a team).
Prefer to send reports from your own tools? A personal API key with Read and submit reports access can do it: see Submitting a report in the API overview. The API is otherwise read-only.
When a program awards you a bounty, add your payout details under Settings → Payouts: a bank account (IBAN, checked before it is saved) or a PayPal address. RootBounty pays you on behalf of the company or, if you allow it, the company transfers the bounty to you directly with no fees. The Earnings list shows every bounty and its payment. All the details in Bounty payments.
Your dashboard lists every report with its status. The program team replies on the report’s timeline, and you get a notification for every status change, comment and bounty. Accepted and resolved reports are certified findings: they build your reputation and, at ten, unlock posting in the community.
Jobs lists security roles — offensive security, AppSec, product security, incident response — published by companies we verified. Filter them and apply on the company's own page.