Three things happened in 2026 that bear on where you collect vulnerability reports. curl stopped paying bounties on 31 January. HackerOne paused new submissions to the Internet Bug Bounty (IBB) in spring, with coverage dated 3 April, and Node.js said it would keep taking reports but no longer pay rewards. On 21 May The Register reported that the IBB's reward table, effective 18 May, had dropped for every severity.
None of this says platforms are finished. It says the money side is less stable than it looked, and your intake should not depend on it.
What's affected
Companies choosing between a hosted bounty or disclosure platform and a self-run channel (a mailbox plus a form, or GitHub private vulnerability reporting). The facts that matter:
| Item | What was reported |
|---|---|
| curl | Bounty ends 31 January 2026. Reports now go through GitHub private vulnerability reporting or email, with no money. The post says confirmed rate fell below 5% from 2025 |
| IBB | Paused; the HackerOne spokesperson said it was "currently paused while we evaluate adjustments". It had run since 2012 and paid more than 1.5 million dollars |
| IBB table | Critical from 9,250 to 2,257 dollars, high from 4,429 to 1,009, medium from 1,843 to 297, low from 597 to 68 |
| Node.js | Accepts reports on the platform, no longer pays |
One researcher described in The Register waited months for a payout and then received a smaller amount than expected because the table changed after submission. If you run a paid program, that is a reputational risk you carry.
How to check if you're exposed
Answer five questions about your current setup:
- If the platform raised prices or closed tomorrow, where would reports go?
- Do your security.txt and policy name a channel you own, such as a mailbox?
- Who triages, and what is their weekly time budget?
- Have you paid for any report that was later found invalid?
- Do you owe anyone money under a published table?
curl -sL https://example.com/.well-known/security.txt | grep -i -E '^(Contact|Policy):'
If every Contact is a platform URL, add a mailbox beside it.
What to do now
- Start with a free channel you control: a shared mailbox and, if your code is on GitHub, private vulnerability reporting.
- Add a platform only if you need its triage staff, its researcher audience or its payment handling, and budget for the triage owner on your side too. A platform does not remove that job.
- Publish a reward table only when you have a funded budget line, and state that amounts may change before you accept the report, not after.
- Keep a non-monetary reward ready: public credit, a thank-you note and a prompt fix.
- List the CVE route you will use. 20 of the 557 CNAs on the CVE partner list are typed as bug bounty providers, so check for a CNA that already covers your product before assuming you need a platform to get an ID.
How to avoid this trap
- Do not make a platform link your only contact. Publish the same email address in security.txt and on
/security. - Do not promise rewards in marketing text. Put terms in a policy page you can version.
- Do not set reward tiers you cannot pay for a worst case month. Model ten valid reports.
- Re-read your policy after any change to the platform's terms.
Why it matters
curl's reason for stopping was that the bounty drew a flood of low quality submissions and wore down the maintainers who had to debunk them. HackerOne's reason for pausing the IBB, as quoted by InfoWorld, was this: "The balance between findings and remediation capacity in open source has substantively shifted." Both say the same thing from different angles: finding bugs is getting cheap, fixing them is not, and an intake that rewards volume pays for the cheap half.
For a customer asking about your disclosure program, a reliable, answered mailbox with honest response times says more than a platform badge.
Try it yourself
Pick your three most important vendors. Check each one's security.txt and policy page for a channel they own and for response times. Then see how a vendor review view records what you found.
Click through it at your own pace, or open it full screen.
Quick check
Why should you not rely only on a platform link as your Contact?
If the platform changes its terms, pauses a program or closes, your reporters have nowhere to go. A mailbox you own keeps working.
Does a platform remove the need for an internal triage owner?
No. You still have to validate, fix and communicate. The platform changes who finds and sorts reports first, not who ships the patch.
