EncryptSec is a bug bounty platform for security researchers and the companies that need them. Public and private programs, scope you can read before you start, reward tiers published up front, and every report triaged by a real security team.
Browse every public program in one directory, read the scope and reward tiers before you spend a weekend on a target, and submit a report with your proof of concept attached. Accepted findings earn a bounty and a place on the leaderboard.
Sign your company up and write your own program — scope, rules and reward tiers. Our team reviews it, then it goes live to researchers. Reports arrive triaged and reproducible, and you pay for valid findings rather than for hours.
The highest reward ceilings on the platform. Anyone can read the scope; join to start submitting.
EncryptSec
EncryptSec is a cybersecurity company based in Kathmandu, Nepal, that provides penetration testing, managed security, and compliance services to global and local enterprises. Core…
Rewards
Bug BountyUSD 25 – USD 100
In scope
2 targets
Researchers
16
Launched
Sep 11, 2026
Skillshikshya
SkillShikshya is an IT training institute and upskilling center based in Kathmandu, Nepal, that focuses on practical, project-based education. Founded in 2019, the academy is desi…
Rewards
VDPSwag / recognition
In scope
3 targets
Researchers
10
Launched
Sep 14, 2026
Three steps from signing up to getting paid.
1.Create your researcher account
Sign up free, pick a handle, and build a public profile that tracks your reputation and signal.
2.Pick a program and read the scope
Every public program lists its in-scope targets, reward tiers and disclosure policy up front.
3.Submit findings, get rewarded
Our triage team validates each report. Accepted findings earn a bounty and reputation points.
Ready to start hunting?
Signing up takes a minute and every public program is open to join.
2 accepted
2 accepted
1 accepted
0 accepted
1 accepted
Encrypt Live
Accepted findings and paid bounties across every public program, as they happen.
Watch the feedThe things that decide whether a program is worth your weekend, said out loud.
Every program states what critical, high, medium and low pay before you start. No negotiating after the fact, and no discovering the ceiling when you hit it.
Reports are read by the EncryptSec research team against the program scope and rules. Nothing is auto-closed by a queue that never looked at it.
Programs say in writing whether they commit not to pursue good-faith research. It is on the card, so you know before you spend a weekend on it.
A program's advertised triage SLA sits next to the time it actually takes. A program that is slow to answer cannot hide it.
Accepted findings earn reputation and a place on the public leaderboard, with a profile you can point an employer at.
Encrypt Live shows accepted findings and paid bounties across every public program as they happen.
Sign your company up, write the scope, rules and reward tiers, and submit the program for review. Our team reads every program before it goes live — then researchers start testing, and reports arrive triaged and reproducible. Free to set up; you pay for valid findings.
What researchers and companies ask before they start.
A bug bounty program is a standing invitation from a company to security researchers: test these systems, report what you find, and get rewarded for valid vulnerabilities. The program states what is in scope, what is excluded, and what each severity pays, so both sides know the terms before any testing starts.
It depends on the program and the severity of what you find. Every program on EncryptSec publishes its reward tiers — critical, high, medium and low — on its public page, so you can see the range before you start. Programs that offer recognition rather than cash are labelled VDP.
No. Public programs are open to anyone with an account, and joining one takes a minute. What matters is the quality of the report: a clear reproduction, evidence, and an honest description of impact.
Each report is triaged by the EncryptSec Research Team against the program scope and rules. You will see the status change on the report itself and can discuss it with the triage team in the thread — reports are not auto-closed by a queue.
Anyone can see and join a public program. A private program is invite-only: it does not appear in the directory, and you can only see its scope after accepting an invitation. Companies typically invite researchers with a track record on the leaderboard.
Sign your company up, then write the program yourself: list the in-scope targets, set the rules of engagement and disclosure policy, and publish what each severity pays. Submit it and our team reviews it — scope, rules and reward tiers — before it goes live to researchers, usually within two business days. Setting a program up is free; you pay the bounties you award.
So that a researcher reading a program brief can trust it. We check the assets in scope belong to the company submitting them, that the rules are ones a researcher can actually follow, and that the reward tiers say something concrete. If something needs changing we say exactly what, and the company can resubmit.
Testing within the published scope and rules of a program is authorised by the company running it, and programs marked with safe harbour commit not to pursue good-faith research legally. Testing anything outside the stated scope is not covered — read the program page first.
Every public program on EncryptSec publishes its scope, its rules and what it pays. Read them, join the one that suits you, and file your first report.
