About vulns.co
A public reference library for security research and bug bounty work. Free to read, free to query, and built from sources you can check.
What is here
- 67 disclosed cases, each with root cause, demonstrated impact, award evidence and a link to the original writeup.
- 43 technique briefs by bug class, with 70 playbooks and 28 checklists behind them.
- 1,164 public program listings, 40 of them with the policy read in full, plus recorded scope changes.
- 155 primary references and 14 original diagrams.
- 108 tools with install and usage, a command generator, and utilities that run in your browser.
- A read-only MCP server and JSON API so agents and scripts can use the same material.
Who runs it
vulns.co is built and maintained by GK Data, which does independent security research, application reviews and website services. The site carries one advertisement, for misconfig.ai. That is a GK Data product, and it is labelled as an advertisement wherever it appears.
How a case gets in
The case library follows a written evidence policy. In short:
- A case needs a primary source from the researcher, the vendor, the platform or a competition organiser that describes an individual award of at least USD 10,000. Advertised maximums and event totals do not count.
- Sources are read in full. A search snippet is never enough for a technical or reward claim.
- The record keeps what was demonstrated separate from what might have been possible, and an award separate from a confirmed payment.
- Publication, report, award and fix dates are stored separately. A date that the source does not give stays empty.
- When sources disagree, the disagreement is recorded instead of being smoothed over.
- Case summaries cover root cause, bounded impact and what to check for. They do not include exploit payloads or reproduction steps.
How program and scope records work
Program listings and scope tables are copied from the official public pages on each platform, with the date they were captured. They are observations, not permission. A listing here does not mean a target is in scope today. The platform's live policy is the only authority, and every program page links to it.
How often it updates
- Cases, references, diagrams and program records come from a pinned snapshot of the public Security Research Library repository. The current snapshot is dated 2026-10-12. A new snapshot is published only after it passes checksum, schema and build checks.
- The feed refreshes hourly from a fixed list of sources: government advisories, vendor security teams, security news outlets and research blogs. It stores titles and links only.
- CVE signals refresh daily from CISA's Known Exploited Vulnerabilities catalog and FIRST's EPSS scores.
- Site changes are listed in the changelog.
Reuse and citation
Original summaries, analysis and diagrams are licensed under CC BY 4.0. Code and schemas are MIT. Linked articles, quotations and trademarks belong to their owners and are not relicensed. The full terms are in the licence file.
To cite a record, link to its page on vulns.co and credit “Security Research Library contributors”. Every page shows the snapshot it was built from. Everything is also available as JSON with schemas.
Corrections and contact
If a record is wrong or out of date, see how to contribute. To report a security problem with the site itself, see security. The content policy and privacy pages cover the rest.