A marketplace for offensive security work lives or dies on who's allowed to sell. Here's exactly how vetting works, so both buyers and prospective researchers know what the badge means.
What "vetted" gates
Only vetted researchers can publish fixed-scope gigs. Anyone can register a researcher account and submit bug bounty reports immediately — the bounty side is judged per report, on reproduction and impact, so it doesn't need a gate. Publishing a gig is a standing offer to buyers, so it does.
What we ask for
- Certifications. OSCP, OSWE, OSCE/OSEP, GXPN, GWAPT, AWS Security Specialty
and equivalents. A cert is necessary context, not sufficient on its own.
- A work sample. A sanitised past report or a PoC write-up. This is the part
that matters most.
- A short statement of what you specialise in and how you scope.
What we look at in the sample
- Structure. Does a finding lead with the capability an attacker gains, or
with the bug class? Is there a structural key — endpoint, precondition, observable, likely patch surface — a triager can act on in seconds?
- Reproduction. Is it minimal? A twelve-step PoC usually means the finding
isn't understood yet, or several issues are stacked.
- Impact reasoning. Is severity argued from what was demonstrated and the
precondition, or asserted from the mechanism? "Deserialisation, therefore critical" is a category error.
- Restraint. Did the tester stop at proving impact, or exfiltrate data as
"proof"?
- Writing. Could a tired engineer act on this in five minutes?
What we don't do
- We don't run a background check or identity-verify beyond the account. A
background-checked tier is on the roadmap for engagements that need it.
- We don't guarantee any researcher's work. Vetting is screening; buyers should
scope engagements accordingly and use the dispute process if a delivery misses scope.
After vetting
You can publish gigs, set your own tiers and prices, and take bounties. Set a payout wallet before your first completed order — changing it later requires your password again and writes an audit record. Reputation and the public leaderboard do the rest.
If you want to sell here, start at For researchers.