We manage private bug bounty programs.
A private programme gives you continuous testing from a small, vetted group of researchers instead of an open crowd. We set the scope and safe harbour, select and verify the researchers, triage and deduplicate every submission, and hand your team only reproducible findings. Researchers: apply below to be considered for the private platform.
Apply to join the private programme
Private programmes are invite-only. We review every application by hand and look at what you have actually found, not how many reports you have filed. If your background fits a programme we are running, we will reach out with the scope and the NDA.
What we need from you
- A verifiable profile: HackerOne, Bugcrowd, Intigriti, YesWeHack or equivalent. Independent researchers are welcome if you can show your work another way.
- Evidence of real findings: disclosed reports, CVEs, hall-of-fame entries or write-ups.
- Willingness to sign an NDA. Private scope never leaves the programme.
- Agreement to the disclosure rules: test only what is in scope, never touch real user data, report through the platform.
Frequently asked questions about private bug bounty programmes
What is a private bug bounty programme?
A private programme gives you continuous testing from a small, vetted group of researchers rather than an open crowd. Scope and safe harbour are set before it starts, researchers are selected and verified, and reports are triaged before they reach your team.
How is it different from a public programme?
A public programme is open to anyone, which means volume and noise. A private programme restricts testing to researchers who have been reviewed and accepted, so you get fewer, higher-signal reports and your scope is not published.
What does PentesterSpace handle?
We set the scope and safe harbour, select and verify the researchers, triage incoming reports and manage payouts. Your team receives findings that have already been reviewed instead of an unfiltered report queue.
Who can apply to join a programme?
Researchers with a verifiable profile on HackerOne, Bugcrowd, Intigriti, YesWeHack or an equivalent platform. Independent researchers are welcome if they can show their work another way, such as disclosed reports, CVEs, hall-of-fame entries or write-ups.
Do researchers have to sign an NDA?
Yes. Private scope never leaves the programme. Researchers also agree to the disclosure rules: test only what is in scope, never touch real user data, and report through the platform.
How long does an application take?
Applications are reviewed by hand, and we look at what you have actually found rather than how many reports you have filed. There is sometimes a queue, so it can take a while, and you will only hear from us if there is a real fit.